---
id: CVE-2026-54239
title: Faust.js is a headless WordPress toolkit
summary: >-
  Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP
  WordPress plugin authenticates only the ciphertext in its token envelope and
  excludes the 16-byte initialization vector from the HMAC in
  WPE\FaustWP\Auth\encrypt() an…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-345
  - CWE-639
vendor: wpengine
product: faustjs
affected:
  - faustjs < 1.8.11
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:23:54.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54239'
references:
  - url: >-
      https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0
    label: security-advisories@github.com
  - url: 'https://github.com/wpengine/faustjs/pull/2386'
    label: security-advisories@github.com
  - url: >-
      https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00323
epssPercentile: 0.22649
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:24:07.874796Z'
ingestedAt: '2026-09-17T19:26:25.316Z'
---

## Overview

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.