What’s Vulnerable › Vulnerabilities

CVE-2026-54239: FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-09-24
• Weakness: CWE-345

Description

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Affected products

• wpengine faustjs: before 1.8.11

References

• https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0
• https://github.com/wpengine/faustjs/pull/2386
• https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3

Get alerted when CVE-2026-54239 or the next vulnerability affects your stack