Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret

Newfold Digital WordPress plugins bundling wp-module-data =2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate method hooked on restauthenticationerrors computes: token = sha256sha256wpjsonencodemethod,url,body,timestamp +...