CVE-2026-80099: Newfold Plugins Auth Bypass Vulnerability

CVE-2026-80099 Overview

CVE-2026-80099 is an authentication bypass vulnerability affecting multiple Newfold WordPress plugins that bundle the wp-module-data module. The flaw resides in the authenticate() method registered on the rest_authentication_errors filter, which evaluates every unauthenticated REST API request. When HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to strrev(''), collapsing the HMAC secret to the publicly known constant hash('sha256', ''). Unauthenticated attackers can compute a valid Bearer token offline and gain administrator-level access. The vulnerability is classified as [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated attackers can forge Bearer tokens, authenticate as the first administrator returned by get_users(['role' => 'administrator']), and achieve complete site takeover through arbitrary REST API operations.

Affected Products

WP Plugin Bluehost (versions <= 4.17.1)
WP Plugin Hostgator (versions <= 3.1.0)
WP Plugin Crazy Domains (versions <= 2.5.2)
WP Plugin Web (versions <= 2.3.4)
Newfold wp-module-data module (versions <= 2.9.4)

Discovery Timeline

2026-09-09 - CVE CVE-2026-80099 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80099

Vulnerability Analysis

The wp-module-data module registers an authenticate() handler on WordPress's rest_authentication_errors filter. This handler runs for every unauthenticated REST API request and attempts to verify a Bearer token using an HMAC-style comparison. The token is computed from four attacker-controlled inputs (HTTP method, request URL, raw request body, and the X-Timestamp header) combined with a site-specific secret salt returned by HiiveConnection::get_auth_token().

On sites that are not connected to Hiive, get_auth_token() returns false. PHP's loose type handling causes strrev(false) to evaluate as strrev(''), producing an empty string. The empty string is then passed to hash('sha256', ''), which resolves to the well-known constant e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. With the salt reduced to a public constant, an attacker can reproduce the full HMAC computation offline and generate a valid signature for any request.

Root Cause

The root cause is missing input validation on the return value of HiiveConnection::get_auth_token(). The authenticate() method proceeds with signature verification even when no valid token exists, allowing PHP type coercion to degrade the cryptographic secret to a predictable public value.

Attack Vector

An unauthenticated remote attacker sends a REST API request with a self-computed Authorization: Bearer <token> header and matching X-Timestamp. Because the signature validates, wp_set_current_user() is invoked against the first administrator account returned by get_users(['role' => 'administrator']). The attacker then invokes any REST endpoint as that administrator, including endpoints that create new administrator users.

php

// Security patch in includes/Data.php (Source: github.com/newfold-labs/wp-module-data)
			return null;
		}

+		// A Hiive request is verified against the site's stored connection token.
+		// A site with no stored token (for example one that is not connected) has
+		// nothing to verify against, so bail and let another auth method handle it
+		// rather than run the signature check against an empty token.
+		if ( empty( HiiveConnection::get_auth_token() ) ) {
+			return $errors;
+		}
+
		$token = str_replace( 'Bearer ', '', $_SERVER['HTTP_AUTHORIZATION'] );

		$data = array(

Source: GitHub Commit 9d913fd. The patch adds an early return when HiiveConnection::get_auth_token() is empty, preventing the degraded signature check.

Detection Methods for CVE-2026-80099

Indicators of Compromise

Unauthenticated REST API requests containing an Authorization: Bearer header combined with an X-Timestamp header targeting Newfold plugin routes.
Creation of new administrator accounts through /wp-json/wp/v2/users without a corresponding authenticated admin session in web server logs.
Successful REST API calls originating from IP addresses that have no prior authenticated activity on the site.
Presence of vulnerable plugin versions: Bluehost <= 4.17.1, Hostgator <= 3.1.0, Crazy Domains <= 2.5.2, or Web <= 2.3.4.

Detection Strategies

Inspect web server access logs for REST API requests with both Authorization: Bearer and X-Timestamp headers on sites that were never connected to Hiive.
Correlate WordPress audit logs for new administrator role assignments against known admin login sessions.
Flag REST API traffic to plugin-specific endpoints from clients that never authenticated through wp-login.php.

Monitoring Recommendations

Enable WordPress activity logging to capture user creation, role changes, and REST API authentication events.
Alert on the installation or activation of plugins outside of change-management windows.
Monitor outbound connections initiated by PHP processes for signs of post-exploitation payload retrieval.

How to Mitigate CVE-2026-80099

Immediate Actions Required

Update WP Plugin Bluehost to 4.19.1, WP Plugin Hostgator to 3.2.1, WP Plugin Crazy Domains to 2.5.3, and WP Plugin Web to 2.3.6 or later.
Update the bundled wp-module-data module to a version after 2.9.4.
Audit administrator accounts and revoke any that were not created by authorized personnel.
Rotate all administrator passwords and invalidate active WordPress sessions after patching.

Patch Information

The upstream fix is commit 9d913fd8fa12796c4d9c09081e4aeccfa5cb1301 in the newfold-labs/wp-module-data repository. Vendor-specific fixes are available in the Bluehost 4.19.1 diff, Hostgator 3.2.1 diff, Crazy Domains 2.5.3 diff, and Web 2.3.6 diff. Additional analysis is available in the Wordfence advisory.

Workarounds

Deactivate the affected Newfold plugin until the patched version can be installed.
Deploy a web application firewall rule that blocks REST API requests carrying an X-Timestamp header on sites that do not use the Hiive integration.
Restrict access to /wp-json/ endpoints to authenticated administrator IP ranges through server-level access controls.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated REST calls with X-Timestamp
SecRule REQUEST_URI "@beginsWith /wp-json/" \
  "id:1026800099,phase:1,deny,status:403,\
   chain,msg:'Block Newfold wp-module-data auth bypass (CVE-2026-80099)'"
  SecRule REQUEST_HEADERS:X-Timestamp "@rx .+" \
    "chain"
    SecRule REQUEST_HEADERS:Authorization "@beginsWith Bearer "