{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "2.5.2"
              },
              {
                "last_affected": "2.9.7"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "bd9642c155735fac8f114ea1eb237da4a72eb267"
            },
            {
              "last_affected": "9abdcb0e9153a6e231c3ff299d9f21a784e0f86c"
            }
          ],
          "repo": "https://github.com/newfold-labs/wp-module-data",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "4.19.0"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "fa91db4bdd3734c98a57fd6c35090e0b54e9ee4a"
            }
          ],
          "repo": "https://github.com/newfold-labs/wp-plugin-bluehost",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "3.2.0"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "e1adef3231b465a84203796c02c872fa744b49ad"
            }
          ],
          "repo": "https://github.com/newfold-labs/wp-plugin-hostgator",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "2.3.5"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8070aaa72423f44c9ef3e5824fb86b447686d8e4"
            }
          ],
          "repo": "https://github.com/newfold-labs/wp-plugin-web",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Wordfence",
    "cwe_ids": [
      "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80099.json"
  },
  "details": "Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' =\u003e 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (\u003c= 2.5.2), WP Plugin Web (\u003c= 2.3.4), WP Plugin Hostgator (\u003c= 3.1.0), WP Plugin Bluehost (\u003c= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4.",
  "id": "CVE-2026-80099",
  "modified": "2026-09-10T03:30:32.909544371Z",
  "published": "2026-09-09T08:28:22.335Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80099.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/newfold-labs/wp-module-data/commit/9d913fd8fa12796c4d9c09081e4aeccfa5cb1301"
    },
    {
      "type": "WEB",
      "url": "https://github.com/newfold-labs/wp-plugin-bluehost/compare/4.19.0...4.19.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/newfold-labs/wp-plugin-crazy-domains/compare/2.5.2...2.5.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/newfold-labs/wp-plugin-hostgator/compare/3.2.0...3.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/newfold-labs/wp-plugin-web/compare/2.3.5...2.3.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80099"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L191"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L201"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L222"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php#L69"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/HiiveConnection.php#L406"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba?source=cve"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret"
}