EUVD-2026-74773

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

CVE-2026-80099 is an unauthenticated authentication bypass in several Newfold-hosted WordPress plugins that bundle the wp-module-data module. When HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to strrev('') inside an HMAC-style Bearer token check, collapsing the secre...