Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret
CVE-2026-80099
Verified
Description
Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.
Severity
High
CVSS Score
8.8
Exploit Probability
3%
Affected Product
wp-module-data,bluehost-wordpress-plugin,hostgator,wp-plugin-web,crazy-domains
Published Date
September 22, 2026
Template Author
ritikchaddha
CVE-2026-80099.yaml
8.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-80099
CWE ID:
cwe-287
Remediation Steps
Update to patched versions: Bluehost >=4.19.1, HostGator >=3.2.1, Web >=2.3.6, Crazy Domains >=2.5.3, or update wp-module-data to >=2.9.8.