Authentication Bypass in Newfold Plugins Affecting WordPress

CVE-2026-80099

What is CVE-2026-80099?

Newfold plugins for WordPress are susceptible to an Authentication Bypass vulnerability. This issue arises from the way the bundled wp-module-data module handles authentication. Specifically, the authenticate() method improperly processes an HMAC-style Bearer token when faced with a false return from HiiveConnection::get_auth_token(). Instead of a valid token, PHP manipulates the input, leading to a predictable salt that is publicly accessible. Attackers can exploit this weakness to create valid Bearer tokens offline, allowing them to impersonate a legitimate administrator without authentication. Consequently, attackers could achieve full administrative access to the site, enabling them to perform arbitrary REST API actions, including creating new admin accounts and potentially taking over the entire website.

References