Executive brief
Several WordPress hosting provider plugins bundled with the wp-module-data authentication library contain a flaw that allows unauthenticated attackers to bypass login requirements and gain full administrator access. An attacker can forge valid authentication tokens offline by exploiting a cryptographic weakness in the token validation logic, then use these tokens to take over the WordPress site, create new admin accounts, and perform arbitrary administrative actions.
Technical details
The vulnerability exists in the wp-module-data module's `authenticate()` method, which validates Bearer tokens using an HMAC-style comparison on the `rest_authentication_errors` filter. When `HiiveConnection::get_auth_token()` returns `false`, PHP type coercion causes `strrev(false)` to collapse to `strrev('')`, resulting in a predictable salt value (SHA-256 hash of empty string: e3b0c44...). Since all remaining hash inputs (HTTP method, URL, request body, X-Timestamp header) are attacker-controlled, an unauthenticated attacker can compute a valid Bearer token entirely offline. Upon successful token validation, the code invokes `wp_set_current_user()` against the first administrator account, granting immediate full administrative REST API access and enabling complete site takeover. The vulnerable module affects wp-module-data up to 2.9.4, with patches available in later versions and dependent plugin versions (Bluehost 4.19.1+, Hostgator 3.1.1+, Web 2.3.5+, Crazy Domains 2.5.3+).
Affected products
- Newfold wp-module-data up to 2.9.4
- Newfold WP Plugin Bluehost up to 4.17.1
- Newfold WP Plugin Hostgator up to 3.1.0
- Newfold WP Plugin Web up to 2.3.4
- Newfold WP Plugin Crazy Domains up to 2.5.2
Timeline
- 2026-09-09: disclosed