CVE-2026-80099VulnerabilityPublished 09/09/2026

CVE-2026-80099: CWE-287 Improper Authentication in Newfold WP Plugin Web

Affects Newfold WP Plugin WebSource CVE Database V5

CVSS 3.1 base score

8.8High

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 2.9% chance of exploitation in 30 days – higher than 86% of CVEs

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider disabling the affected plugins or restricting REST API access to trusted users only to mitigate risk.

Affected software

Product	Affected	Fixed in
NewfoldWP Plugin Web	Affected >=0 <=2.3.5	Fixed in–
NewfoldWP Plugin Crazy Domains	Affected >=0 <=2.5.2	Fixed in–
NewfoldWP Module Data	Affected >=0 <=2.9.7	Fixed in–
NewfoldWP Plugin Hostgator	Affected >=0 <=3.2.0	Fixed in–
NewfoldWP Plugin Bluehost	Affected >=0 <=4.19.0	Fixed in–
GitHub Actionsnewfold-labs/wp-module-data`pkg:github/newfold-labs/wp-module-data`Other threats	Affected <=2.9.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4.

Summary

The vulnerability arises from the wp-module-data module's `authenticate()` method, which is hooked into the `rest_authentication_errors` filter and invoked on every unauthenticated REST API request. If `HiiveConnection::get_auth_token()` returns false, PHP coerces the token to an empty string, causing the secret salt to collapse to a known constant hash value. Since other inputs to the HMAC are attacker-controlled, an attacker can compute a valid Bearer token offline. Passing this token bypasses authentication, causing `wp_set_current_user()` to set the current user to the first administrator returned by `get_users(['role' => 'administrator'])`. This grants full administrator privileges, enabling arbitrary REST API operations and complete site compromise. Affected versions include WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1), and the vulnerable module itself up to 2.9.4.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrator-level access to WordPress sites using the affected plugins. This includes the ability to perform any REST API operation, such as creating new administrator accounts, modifying site content, and potentially taking complete control of the site. The impact is high, affecting confidentiality, integrity, and availability of the affected WordPress installations.

Weaknesses

CWE-287Improper Authentication (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 09/09/2026, 08:52:12 UTC

Technical details

Weaknesses

References

Related threats