Critical findings.

Audited release

3.3.1

Findings

2

Worst severity

critical

Content hash

341170cbe2be9026042e1d96… Copy

Findings

• critical Unauthenticated administrator impersonation via bundled wp-module-data 2.9.3 Bearer HMAC (CVE-2026-80099)

  auth_bypass

  This plugin's GitHub release zip is built with composer install --no-dev (.github/workflows/upload-asset-on-release.yml). composer.lock pins newfold-labs/wp-module-data 2.9.3 (git 8420d78), which Wordfence/CVE-2026-80099 marks vulnerable through 2.9.4 (module patched in 2.9.8). Sibling brand plugins (Bluehost, HostGator, Web.com, Crazy Domains) were listed; this GitHub-distributed plugin was not, but it ships the same module. The module autoloads bootstrap.php and Data::start() registers authenticate() on rest_authentication_errors for every REST request. authenticate() builds salt = sha256(strrev(HiiveConnection::get_auth_token())). get_auth_token() returns get_option('nfd_data_token'), which is false until Hiive connect() succeeds (the default on fresh / failed / 401-cleared installs). PHP coerces strrev(false) to strrev(''), so salt is the public constant sha256('') = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Method, URL, raw body, and X-Timestamp are attacker-controlled, so a valid Bearer token is computed offline. On match, wp_set_current_user() is called for $_GET['user_id'] or the first administrator. Observable consequence: unauthenticated POST /wp-json/wp/v2/users as that admin creates a new administrator (complete takeover). Also unlocks /mojo/v1/settings (nfd_coming_soon, auto-updates, homepage) and /newfold-sso/v1/sso (magic login cookie). Condition: nfd_data_token unset/false and NFD_HIIVE_AUTH_TOKEN undefined.

  composer.lock:388-390

  Recommendation

  Bump newfold-labs/wp-module-data to 2.9.8 or later (the patched release for CVE-2026-80099), regenerate composer.lock, and ship a new GitHub release. Refuse authentication when get_auth_token() is empty/false; use hash_equals; do not map a forged Bearer token to an administrator. Sites should rotate administrator passwords/sessions if they ran 3.3.1 without a Hiive token.

• high Unauthenticated plugin install and activation via nfdplugin query parameter

  missing_auth

  NFD_Plugin_Upgrade::return_instance() is called from bootstrap.php on every request (not wrapped in is_admin()). primary_init() hooks intercept_query_parameter to wp_loaded with no capability check and no nonce. Any visitor who sends GET ?nfdplugin=bluehost or ?nfdplugin=hostgator causes plugin_upgrade(): if the target is missing, install_plugin() runs Plugin_Upgrader::install() against a hardcoded hiive.cloud zip URL using Plugin_Quiet_Upgrader_Skin (no filesystem credential UI); then activate_plugin() runs activation hooks. The ZIP host is not attacker-controlled, so this is not arbitrary plugin install, but it is unauthenticated privileged plugin installation/activation. On typical Newfold/shared hosts with FS_METHOD direct this succeeds without FTP credentials. Activating Bluehost or HostGator then trips NFD_Plugin_Compat_Check incompatible_plugins and self-deactivates Mojo, swapping the hosting plugin. Also CSRF: a logged-in admin who visits an attacker page that loads https://victim/?nfdplugin=bluehost triggers the same path. Observable consequence: unauthorized write under wp-content/plugins/, plugin activation, and replacement of the active hosting plugin.

  inc/plugin-nfd-upgrade.php:82-184

  Recommendation

  Remove the public query-parameter installer, or gate it with is_admin(), current_user_can('install_plugins'), current_user_can('activate_plugins'), and a valid nonce. Do not run Plugin_Upgrader or activate_plugin() on wp_loaded for unauthenticated requests.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.