The vulnerability is a true authentication bypass that occurs when a public HMAC‑style Bearer token comparison in the `wp-module-data` module degenerates because the internal secret lock is missing. When `HiiveConnection::get_auth_token()` returns a false value, PHP coerces the reverse operation to an empty string, collapsing the secret salt to a publicly known SHA‑256 hash. Because the HTTP method, request URL, body, and timestamp fields remain fully controllable by the attacker, a completely offline calculation of a valid Bearer token is possible. Any unauthenticated REST API request that provides this token will be accepted, allowing WordPress to call `wp_set_current_user()` on the first administrator returned by `get_users(['role'=>'administrator'])`. From that point the attacker can perform any privileged operation, including the creation of new administrator accounts and full site takeover.

Newfold plugins are affected: WP Plugin Crazy Domains up to and including 2.5.2, WP Plugin Web up to 2.3.4, WP Plugin Hostgator up to 3.1.0, WP Plugin Bluehost up to 4.17.1. The underlying wp-module-data component is vulnerable in all versions up to 2.9.4. These plugins are distributed by Newfold for use as WordPress extensions and are widely deployed among WordPress sites.

The CVSS v3.1 score of 8.8 indicates high severity. The EPSS score is unavailable, but the lack of a KEV listing does not reduce the risk; the vulnerability is exploitable by any unauthenticated user with access to a site’s REST API, and the token can be calculated offline from publicly known information. Given the broad scope and the potential to gain full administrative control, the overall risk is significant and actionable before exploit is observed.