Newfold WP Module Data

WPdeeply September 10, 2026 2 min read

Newfold WordPress authentication bypass vulnerability advisory

CVE-2026-80099 affects several Newfold WordPress plugins that bundle the WP Module Data component. The public records cover WP Plugin Bluehost, WP Plugin HostGator, WP Plugin Web, WP Plugin Crazy Domains, and WP Module Data itself.

The authentication bypass is in REST API authentication. When the stored Hiive connection token is missing, the affected Bearer-token check can collapse to request values the attacker controls. A successful bypass can make the request run as an administrator and allow administrator-level REST API actions.

Table of Contents

Affected versions

WP Plugin Bluehost: up to and including 4.19.0
WP Plugin HostGator: up to and including 3.2.0
WP Plugin Web: up to and including 2.3.5
WP Plugin Crazy Domains: up to and including 2.5.2
WP Module Data: up to and including 2.9.7

Patch and verification

Update the affected Newfold or hosting plugin to the newest available release immediately.
If the hosting dashboard integration is not required, deactivate and remove it after confirming it is safe for the site.
Review administrator accounts created or modified since September 8, 2026.
Rotate administrator passwords and application passwords if an affected plugin was active.
Inspect REST API and access logs for unexpected administrator-level requests.

WP-CLI checks

wp plugin list --fields=name,status,version,update,update_version --format=table
wp plugin get wp-plugin-bluehost --fields=name,status,version,update_version --format=table
wp plugin get wp-plugin-hostgator --fields=name,status,version,update_version --format=table
wp plugin get wp-plugin-web --fields=name,status,version,update_version --format=table
wp plugin get wp-plugin-crazy-domains --fields=name,status,version,update_version --format=table
wp plugin get wp-module-data --fields=name,status,version,update_version --format=table
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table

Temporary mitigation

If an immediate update is not possible, temporarily disable Bearer-token REST authentication while the plugin is removed or patched. Remove this after updating because it can break legitimate Bearer-token integrations.

<?php
add_filter( 'rest_authentication_errors', function ( $result ) {
    if ( ! empty( $result ) ) { return $result; }
    $authorization = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
    if ( stripos( $authorization, 'Bearer ' ) === 0 ) {
        return new WP_Error( 'wpdeeply_bearer_temporarily_disabled', 'Bearer REST authentication is temporarily disabled while vulnerable Newfold plugins are patched.', array( 'status' => 403 ) );
    }
    return $result;
}, 1 );

Sources

WPdeeply

WPDeeply is the site's editorial account for WordPress security advisories, plugin risk research, and remediation guides. Articles under this byline are checked against vendor changelogs, CVE records, vulnerability database entries, and the WPDeeply editorial policy before publication.

wpdeeply.com All posts by this author