The MyHome Core plugin for WordPress is vulnerable to an authentication bypass that allows an unauthenticated attacker to generate an activation token for an unconfirmed user account and acquire a valid authentication cookie. This flaw stems from missing authorization in the send_link AJAX handler and inadequate token validation in the activate() function. The result is an account takeover, including administrative accounts, if the target account is not yet confirmed.

Affected are installations of TangibleWP MyHome Core plugins version 4.4.5 or earlier that are configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and whose users lack the myhome_agent_confirmed meta value.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The exploitation does not require special network access beyond reachability of the site; it can be performed by any visitor to the site. The attacker can issue the send_link request, receive an activation token, then use it in the activate() call to gain authentication. The attack can lead to full compromise of the WordPress installation due to elevation to administrator status.