Authentication Bypass in Newfold WordPress Plugins via wp-module-data

Researchers have identified a critical authentication bypass vulnerability (CVE-2026-80099) affecting the wp-module-data library, which is bundled with several Newfold Digital WordPress plugins. The vulnerability is triggered when the authenticate() method - registered via the rest_authentication_errors filter - encounters a failure in HiiveConnection::get_auth_token(). Under these conditions, PHP type coercion causes the secret HMAC salt to collapse into a publicly known static constant.

An unauthenticated attacker can control the remaining inputs required for the HMAC calculation, including the HTTP method, request URI, raw body, and the X-Timestamp header. This allows the attacker to compute a valid Bearer token offline. Once forged, the token permits the attacker to bypass authentication and invoke wp_set_current_user() as an administrator. This vulnerability grants attackers complete control over affected WordPress installations, enabling actions such as creating new administrative users or installing arbitrary malicious plugins, which effectively leads to total site compromise. The issue affects multiple plugins, including Crazy Domains, WP Plugin Web, Hostgator, and Bluehost.

Impact

Successful exploitation leads to full administrator-level access to the vulnerable WordPress installation. Threat actors can use this access to exfiltrate database contents, deploy web shells for persistence, inject malicious scripts, or host phishing content. This affects all organizations relying on the specified versions of the affected Newfold plugins for their web infrastructure.

Recommendation

Prioritized actions for security and IT teams:

• Immediately identify and audit all WordPress installations for the affected plugins: Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), Hostgator (<= 3.1.0), and Bluehost (<= 4.17.1).
• Update all instances of wp-module-data to a version beyond 2.9.4 and update associated plugins to the latest available patched versions.
• Until patching is possible, restrict access to the REST API endpoints associated with the vulnerable plugins using firewall rules or web application firewall (WAF) policies.
• Review WordPress user lists for any unauthorized administrative accounts created or modified since the release of this advisory.