FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

published 2026-09-17 52 d ago modified 2026-09-24 45 d ago also EUVD-2026-82383

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Patch / fix

links 2

github.com/wpengine/faustjs@cda00de commit
github.com/wpengine/faustjs#2386 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 51 d ago (2026-09-18)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

wpengine faustjs

Classification

Weakness

CWE-345 Insufficient Verification of Data Authenticity
CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

CVE List CVE-2026-54239
NVD CVE-2026-54239

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary