An unauthenticated attacker can control the remaining inputs required for the HMAC calculation, including the HTTP method, request URI, raw body, and the X-Timestamp header. This allows the attacker to compute a valid Bearer token offline. Once forged, the token permits the attacker to bypass authentication and invoke wp_set_current_user() as an administrator. This vulnerability grants attackers complete control over affected WordPress installations, enabling actions such as creating new administrative users or installing arbitrary malicious plugins, which effectively leads to total site compromise. The issue affects multiple plugins, including Crazy Domains, WP Plugin Web, Hostgator, and Bluehost.

Impact

Successful exploitation leads to full administrator-level access to the vulnerable WordPress installation. Threat actors can use this access to exfiltrate database contents, deploy web shells for persistence, inject malicious scripts, or host phishing content. This affects all organizations relying on the specified versions of the affected Newfold plugins for their web infrastructure.

Recommendation

Prioritized actions for security and IT teams:

• Immediately identify and audit all WordPress installations for the affected plugins: Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), Hostgator (<= 3.1.0), and Bluehost (<= 4.17.1).
• Update all instances of wp-module-data to a version beyond 2.9.4 and update associated plugins to the latest available patched versions.
• Until patching is possible, restrict access to the REST API endpoints associated with the vulnerable plugins using firewall rules or web application firewall (WAF) policies.
• Review WordPress user lists for any unauthorized administrative accounts created or modified since the release of this advisory.