Various Newfold Plugins Various Versions — Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP Plugin Hostgator.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.2.1, or a newer patched version
2. Update to version 2.9.8, or a newer patched version
3. Update to version 2.5.3, or a newer patched version
4. Update to version 2.3.6, or a newer patched version
5. Update to version 4.19.1, or a newer patched version
6. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
7. Watch WP Plugin Hostgator to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to sorin vasile.

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Sep 8, 2026

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated