The vulnerability arises from the wp-module-data module's `authenticate()` method, which is hooked into the `rest_authentication_errors` filter and invoked on every unauthenticated REST API request. If `HiiveConnection::get_auth_token()` returns false, PHP coerces the token to an empty string, causing the secret salt to collapse to a known constant hash value. Since other inputs to the HMAC are attacker-controlled, an attacker can compute a valid Bearer token offline. Passing this token bypasses authentication, causing `wp_set_current_user()` to set the current user to the first administrator returned by `get_users(['role' => 'administrator'])`. This grants full administrator privileges, enabling arbitrary REST API operations and complete site compromise. Affected versions include WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1), and the vulnerable module itself up to 2.9.4.

Successful exploitation allows unauthenticated attackers to gain full administrator-level access to WordPress sites using the affected plugins. This includes the ability to perform any REST API operation, such as creating new administrator accounts, modifying site content, and potentially taking complete control of the site. The impact is high, affecting confidentiality, integrity, and availability of the affected WordPress installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider disabling the affected plugins or restricting REST API access to trusted users only to mitigate risk.