A critical authentication bypass vulnerability in the TangibleWP MyHome Core plugin allows unauthenticated attackers to gain full administrative access to affected WordPress sites.

The plugin suffers from improper authorization in the send_link() and activate() functions, which permits unauthenticated attackers to generate valid activation tokens for user accounts. This allows an attacker to bypass authentication mechanisms and obtain a valid session cookie for any target account, provided specific theme configurations are active.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker full control over the WordPress installation, leading to complete data compromise, potential distribution of malicious content, and total loss of administrative oversight.

Immediate Action: Review the vendor documentation for the latest security release and update the MyHome Core plugin immediately. If a patch is not yet available, disable the plugin until a secure version is provided by TangibleWP.

Proactive Monitoring: Inspect WordPress user account logs for anomalous registration activity or unexpected account activations. Monitor server access logs for repeated requests to the vulnerable AJAX endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the affected AJAX handlers. Additionally, ensure that frontend registration features are disabled if they are not strictly required for business operations.

Public Exploit Available: No

Given the critical CVSS severity and the potential for full administrative takeover, this vulnerability poses an extreme risk to site integrity. Organizations currently using the MyHome Core plugin should prioritize an immediate update or temporarily deactivate the component to prevent unauthorized access.