Wp Module Data
Monthly
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.