Several Newfold WordPress plugins are vulnerable to a critical authentication bypass flaw that permits unauthenticated attackers to achieve full site takeover.

The vulnerability originates in the authenticate() method of the wp-module-data module, which fails to properly validate HMAC tokens when a connection error occurs. This allows an unauthenticated attacker to bypass security checks and escalate privileges to the administrative level, enabling full control over the affected WordPress installation.

Successful exploitation of this vulnerability grants an attacker complete administrative control over the WordPress site. This leads to severe consequences, including the unauthorized exfiltration of sensitive user data, the injection of malicious content, and total system compromise. Given the CVSS score of 8.8, this risk is categorized as high, necessitating immediate remediation to prevent site takeover.

Immediate Action: Update all affected Newfold plugins to the latest available versions (e.g., Hostgator 3.2.1 or later) to ensure the vulnerable wp-module-data component is patched.

Proactive Monitoring: Review WordPress administrative user logs for any suspicious account creations or unexpected changes to site settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious REST API requests that attempt to authenticate via malformed or unexpected Bearer tokens.

Public Exploit Available: No (exploit_available: false)

Due to the severity of this authentication bypass, administrators must prioritize updating all affected plugins immediately. Failure to patch these components leaves the site vulnerable to full administrative takeover by any remote, unauthenticated attacker. Administrators should verify that the wp-module-data module is updated across all installed Newfold plugins to ensure the vulnerability is fully remediated.