CVE-2026-80099

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

What to do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.