Newfold Plugins CVE-2026-80099

Exploitation requires that the targeted WordPress site has the vulnerable Newfold plugin installed AND that get_option('nfd_data_token') returns false or empty - meaning the site has not completed the Hiive service connection setup. Sites actively connected to the Hiive service with a valid stored token are NOT vulnerable via this path, as the stored token provides a genuine, non-trivially-forgeable secret salt. The attacker must be able to reach the WordPress REST API endpoint over the network (standard HTTP/HTTPS to port 80/443). No authentication, no local access, no social engineering, and no special network position are required. The X-Timestamp header value is attacker-supplied and there is no server-side nonce or replay protection described, meaning a valid token can be reused within any timestamp window the server accepts. Sites where the plugin is installed but the Hiive connection is absent - such as new deployments or sites where the hosting account link was revoked - represent the exploitable population.

The real-world risk is critical for affected sites despite the provided CVSS base score of 8.8 with PR:L. The CVSS vector PR:L conflicts with the description, which explicitly states 'unauthenticated attackers' - the correct PR metric is PR:N, which would yield a base score of 9.8. The attack requires no authentication, no user interaction, and no special network position (AV:N/AC:L), and full administrator access (C:H/I:H/A:H) is achieved in a single authenticated REST API call. The exploitation condition - the absence of a stored Hiive connection token - represents a meaningful limiting factor: sites that have successfully connected to the Hiive service store a real token and are not vulnerable to this specific degenerate path. However, newly installed or never-connected sites (e.g., fresh plugin installations, sites where the connection was revoked) are immediately exposed. No EPSS score was provided, no CISA KEV listing exists, and no standalone POC tool has been confirmed, but Wordfence's publication includes exact source code line references (Data.php L191, L201, L222, HiiveConnection.php L406) that reduce reverse-engineering effort to near-zero. Given the scale of Bluehost and Hostgator's WordPress user bases (tens of millions of hosted sites), even a small fraction of unconnected installations represents a large absolute attack surface. This should be treated as a critical priority for any organization running these plugins.

An attacker scans for WordPress sites running Bluehost or Hostgator plugins with no Hiive service token stored (e.g., freshly installed or never-connected). The attacker computes a valid Bearer token offline by using the known SHA-256 empty-string hash as the salt, combining it with a crafted JSON payload containing attacker-chosen HTTP method, URL, body, and a current Unix timestamp in the X-Timestamp header. The attacker sends a single unauthenticated POST request to the WordPress REST API (e.g., /wp-json/wp/v2/users to create a new administrator account) with the forged Bearer token, and WordPress authenticates the request as the site's first administrator, completing full site takeover.