CVE-2026-80099

The vulnerability is a true authentication bypass that occurs when a public HMAC‑style Bearer token comparison in the wp‑module‑data module degenerates because the internal secret lock is missing. When HiiveConnection::get_auth_token() returns a false value, PHP coerces the reverse operation to an empty string, collapsing the secret salt to a publicly known SHA‑256 hash. Because the HTTP method, request URL, body, and timestamp fields remain fully controllable by the attacker, a completely offline calculation of a valid Bearer token is possible. Any unauthenticated REST API request that provides this token will be accepted, allowing WordPress to call wp_set_current_user() on the first administrator returned by get_users(['role'=>'administrator']). From that point the attacker can perform any privileged operation, including the creation of new administrator accounts and full site takeover.

Newfold plugins are affected: WP Plugin Crazy Domains up to and including 2.5.2, WP Plugin Web up to 2.3.4, WP Plugin Hostgator up to 3.1.0, WP Plugin Bluehost up to 4.17.1. The underlying wp‑module‑data component is vulnerable in all versions up to and including 2.9.4. These plugins are distributed by Newfold for use as WordPress extensions and are widely deployed among WordPress sites.

The CVSS v3.1 score of 8.8 indicates high severity. The EPSS score of 3% indicates a low but nonzero probability of exploitation. The vulnerability is still not listed in KEV; it remains exploitable by any unauthenticated user with access to a site’s REST API, and the token can be calculated offline from publicly known information. Given the broad scope and potential to gain full administrative control, overall risk remains significant and actionable before any exploitation is observed.