Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54239FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

High 8.8

In plain English

A high-severity insufficient verification of data authenticity in faustjs from wpengine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 74.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Affected products (as reported)

Vendor	Product	Versions
wpengine	faustjs	< 1.8.11

Weakness: CWE-345, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3 x_refsource_CONFIRM
https://github.com/wpengine/faustjs/pull/2386 x_refsource_MISC
https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0 x_refsource_MISC