blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-54239

HIGH 8.8 CVSS 3.1
Published
September 17, 2026
Last modified
September 24, 2026
NVD status
Awaiting Analysis
Reported by
security-advisories@github.com
Weakness
CWE-345, CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Affected products and versions

  • wpengine faustjs — Version < 1.8.11

References

  • github.com https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0
  • github.com https://github.com/wpengine/faustjs/pull/2386
  • github.com https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3
  • nvd.nist.gov Official NVD record