CVE-2026-54239: FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FaustWP WordPress plugin (Faust.js headless WordPress toolkit)to a version that resolves this vulnerability.Fixed in 1.8.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be logged in as a non-administrator and be able to obtain an authorization code from the GET /generate endpoint. They can then alter the token envelope’s unauthenticated initialization vector to obtain an Administrator access token.
What level of access can exploitation provide?
Successful exploitation can provide full WordPress REST API access as an Administrator. The described impact includes creating administrator accounts, installing plugins, and achieving arbitrary code execution.
Which versions are affected and what fixes the issue?
FaustWP plugin versions prior to 1.8.11 are affected. Updating the repository version to 1.8.11 fixes the issue.