CVE-2026-80099— Newfold WP Plugin Web 授权问题漏洞
一分钟漏洞结论
影响对象
Newfold WP Plugin Web
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Newfold WP Plugin Web是Newfold公司的一款内容管理系统的插件组件。 Newfold WP Plugin Web 2.3.5及之前版本、WP Plugin Crazy Domains 2.5.2及之前版本、WP Module Data 2.9.7及之前版本、WP Plugin Hostgator 3.2.0及之前版本和WP Plugin Bluehost 4.19.0及之前版本存在授权问题漏洞，该漏洞源于插件捆绑的wp-module-data模块中authenticate()方法在
公开利用映射 1
Nuclei · 1
CVE-2026-80099.yaml [template]
已观察到在野利用
github_trending · low
影响版本矩阵 5
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Newfold | WP Module Data | ≤ 2.9.7 |
affected |
| Newfold | WP Plugin Bluehost | ≤ 4.19.0 |
affected |
| Newfold | WP Plugin Crazy Domains | ≤ 2.5.2 |
affected |
| Newfold | WP Plugin Hostgator | ≤ 3.2.0 |
affected |
| Newfold | WP Plugin Web | ≤ 2.3.5 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-80099 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
来源: CVE Program / CVE List V5
Vulnerability Description
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2), WP Plugin Web (<= 2.3.4), WP Plugin Hostgator (<= 3.1.0), WP Plugin Bluehost (<= 4.17.1). The affected module is vulnerable in versions up to, and including, 2.9.4.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
Newfold WP Plugin Web 授权问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Newfold WP Plugin Web是Newfold公司的一款内容管理系统的插件组件。 Newfold WP Plugin Web 2.3.5及之前版本、WP Plugin Crazy Domains 2.5.2及之前版本、WP Module Data 2.9.7及之前版本、WP Plugin Hostgator 3.2.0及之前版本和WP Plugin Bluehost 4.19.0及之前版本存在授权问题漏洞，该漏洞源于插件捆绑的wp-module-data模块中authenticate()方法在
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Newfold | WP Plugin Web | 0 ~ 2.3.5 | - |
|
| Newfold | WP Plugin Crazy Domains | 0 ~ 2.5.2 | - |
|
| Newfold | WP Module Data | 0 ~ 2.9.7 | - |
|
| Newfold | WP Plugin Hostgator | 0 ~ 3.2.0 | - |
|
| Newfold | WP Plugin Bluehost | 0 ~ 4.19.0 | - |
|
二、漏洞 CVE-2026-80099 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-80099.yaml | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-80099 的情报信息
请登录查看更多情报信息。