CVE-2026-80099: Newfold Plugins Auth Bypass Vulnerability

CVE-2026-80099 Overview

CVE-2026-80099 is an authentication bypass vulnerability affecting multiple Newfold WordPress plugins that bundle the wp-module-data module. The flaw resides in the authenticate() method registered on the rest_authentication_errors filter, which evaluates every unauthenticated REST API request. When HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to strrev(''), collapsing the HMAC secret to the publicly known constant hash('sha256', ''). Unauthenticated attackers can compute a valid Bearer token offline and gain administrator-level access. The vulnerability is classified as [CWE-287] Improper Authentication.

Critical Impact

Unauthenticated attackers can forge Bearer tokens, authenticate as the first administrator returned by get_users(['role' => 'administrator']), and achieve complete site takeover through arbitrary REST API operations.

Affected Products

• WP Plugin Bluehost (versions <= 4.17.1)
• WP Plugin Hostgator (versions <= 3.1.0)
• WP Plugin Crazy Domains (versions <= 2.5.2)
• WP Plugin Web (versions <= 2.3.4)
• Newfold wp-module-data module (versions <= 2.9.4)

Discovery Timeline

• 2026-09-09 - CVE CVE-2026-80099 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80099

Vulnerability Analysis

The wp-module-data module registers an authenticate() handler on WordPress's rest_authentication_errors filter. This handler runs for every unauthenticated REST API request and attempts to verify a Bearer token using an HMAC-style comparison. The token is computed from four attacker-controlled inputs (HTTP method, request URL, raw request body, and the X-Timestamp header) combined with a site-specific secret salt returned by HiiveConnection::get_auth_token().

On sites that are not connected to Hiive, get_auth_token() returns false. PHP's loose type handling causes strrev(false) to evaluate as strrev(''), producing an empty string. The empty string is then passed to hash('sha256', ''), which resolves to the well-known constant e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. With the salt reduced to a public constant, an attacker can reproduce the full HMAC computation offline and generate a valid signature for any request.

Root Cause

The root cause is missing input validation on the return value of HiiveConnection::get_auth_token(). The authenticate() method proceeds with signature verification even when no valid token exists, allowing PHP type coercion to degrade the cryptographic secret to a predictable public value.

Attack Vector

An unauthenticated remote attacker sends a REST API request with a self-computed Authorization: Bearer <token> header and matching X-Timestamp. Because the signature validates, wp_set_current_user() is invoked against the first administrator account returned by get_users(['role' => 'administrator']). The attacker then invokes any REST endpoint as that administrator, including endpoints that create new administrator users.

// Security patch in includes/Data.php (Source: github.com/newfold-labs/wp-module-data)
			return null;
		}

+		// A Hiive request is verified against the site's stored connection token.
+		// A site with no stored token (for example one that is not connected) has
+		// nothing to verify against, so bail and let another auth method handle it
+		// rather than run the signature check against an empty token.
+		if ( empty( HiiveConnection::get_auth_token() ) ) {
+			return $errors;
+		}
+
		$token = str_replace( 'Bearer ', '', $_SERVER['HTTP_AUTHORIZATION'] );

		$data = array(

Source: GitHub Commit 9d913fd. The patch adds an early return when HiiveConnection::get_auth_token() is empty, preventing the degraded signature check.

Detection Methods for CVE-2026-80099

Indicators of Compromise

• Unauthenticated REST API requests containing an Authorization: Bearer header combined with an X-Timestamp header targeting Newfold plugin routes.
• Creation of new administrator accounts through /wp-json/wp/v2/users without a corresponding authenticated admin session in web server logs.
• Successful REST API calls originating from IP addresses that have no prior authenticated activity on the site.
• Presence of vulnerable plugin versions: Bluehost <= 4.17.1, Hostgator <= 3.1.0, Crazy Domains <= 2.5.2, or Web <= 2.3.4.

Detection Strategies

• Inspect web server access logs for REST API requests with both Authorization: Bearer and X-Timestamp headers on sites that were never connected to Hiive.
• Correlate WordPress audit logs for new administrator role assignments against known admin login sessions.
• Flag REST API traffic to plugin-specific endpoints from clients that never authenticated through wp-login.php.

Monitoring Recommendations

• Enable WordPress activity logging to capture user creation, role changes, and REST API authentication events.
• Alert on the installation or activation of plugins outside of change-management windows.
• Monitor outbound connections initiated by PHP processes for signs of post-exploitation payload retrieval.

How to Mitigate CVE-2026-80099

Immediate Actions Required

• Update WP Plugin Bluehost to 4.19.1, WP Plugin Hostgator to 3.2.1, WP Plugin Crazy Domains to 2.5.3, and WP Plugin Web to 2.3.6 or later.
• Update the bundled wp-module-data module to a version after 2.9.4.
• Audit administrator accounts and revoke any that were not created by authorized personnel.
• Rotate all administrator passwords and invalidate active WordPress sessions after patching.

Patch Information

The upstream fix is commit 9d913fd8fa12796c4d9c09081e4aeccfa5cb1301 in the newfold-labs/wp-module-data repository. Vendor-specific fixes are available in the Bluehost 4.19.1 diff, Hostgator 3.2.1 diff, Crazy Domains 2.5.3 diff, and Web 2.3.6 diff. Additional analysis is available in the Wordfence advisory.

Workarounds

• Deactivate the affected Newfold plugin until the patched version can be installed.
• Deploy a web application firewall rule that blocks REST API requests carrying an X-Timestamp header on sites that do not use the Hiive integration.
• Restrict access to /wp-json/ endpoints to authenticated administrator IP ranges through server-level access controls.

# Example WAF rule (ModSecurity) blocking unauthenticated REST calls with X-Timestamp
SecRule REQUEST_URI "@beginsWith /wp-json/" \
  "id:1026800099,phase:1,deny,status:403,\
   chain,msg:'Block Newfold wp-module-data auth bypass (CVE-2026-80099)'"
  SecRule REQUEST_HEADERS:X-Timestamp "@rx .+" \
    "chain"
    SecRule REQUEST_HEADERS:Authorization "@beginsWith Bearer "