CVE-2026-80099

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80099
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80099.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80099
Published
2026-09-09T08:28:22Z
Modified
2026-09-10T03:49:57Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
Details

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate() method — registered on the rest_authentication_errors filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when HiiveConnection::get_auth_token() returns false: PHP coerces strrev(false) to strrev(''), collapsing the secret salt to the publicly known constant hash('sha256', '') = e3b0c44..., while all remaining hash inputs (HTTP method, request URL, raw request body, and the X-Timestamp header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have wp_set_current_user() invoked against the first administrator returned by get_users(['role' => 'administrator']), granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4.

Database specific 
{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80099.json"
}
References

Affected packages

Git
github.com/newfold-labs/wp-module-data

Affected ranges

Type
GIT
Repo
https://github.com/newfold-labs/wp-module-data
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
bd9642c155735fac8f114ea1eb237da4a72eb267
Last Affected
9abdcb0e9153a6e231c3ff299d9f21a784e0f86c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.2"
        },
        {
            "last_affected": "2.9.7"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.1.1
0.1.2
1.*
1.0
1.0.1
1.0.2
1.1
1.2
1.2.1
1.3
1.4
1.4.1
1.4.2
1.4.3
1.5
1.6
1.6.1
1.7
1.8
1.8.1
1.8.2
1.8.3
2.*
2.0.0
2.0.0.beta1
2.0.1
2.1
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.10
2.4.11
2.4.12
2.4.13
2.4.14
2.4.15
2.4.16
2.4.17
2.4.18
2.4.19
2.4.2
2.4.20
2.4.21
2.4.22
2.4.23
2.4.24
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.13
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.2
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80099.json"
github.com/newfold-labs/wp-plugin-bluehost

Affected ranges

Type
GIT
Repo
https://github.com/newfold-labs/wp-plugin-bluehost
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
fa91db4bdd3734c98a57fd6c35090e0b54e9ee4a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.19.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.10.0
4.11.0
4.12.0
4.12.1
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.14.2
4.15.0
4.15.1
4.16.0
4.16.1
4.17.0
4.17.1
4.17.2
4.17.3
4.18.0
4.18.1
4.18.2
4.19.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.10
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.6.0
4.6.1
4.6.2
4.6.3
4.7.0
4.7.1
4.7.2
4.8.0
4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80099.json"
github.com/newfold-labs/wp-plugin-hostgator

Affected ranges

Type
GIT
Repo
https://github.com/newfold-labs/wp-plugin-hostgator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e1adef3231b465a84203796c02c872fa744b49ad
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.2
0.9.3
0.9.4
0.9.6
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.1
1.2.0
1.2.10
1.2.9
2.*
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.13.0
2.13.1
2.13.2
2.13.3
2.14.0
2.14.1
2.15.0
2.15.1
2.15.2
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.1
2.9.2
2.9.3
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80099.json"
github.com/newfold-labs/wp-plugin-web

Affected ranges

Type
GIT
Repo
https://github.com/newfold-labs/wp-plugin-web
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
8070aaa72423f44c9ef3e5824fb86b447686d8e4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.9.0
0.9.1
0.9.2
1.*
1.0.0
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.3.0
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80099.json"