CVE-2026-54239

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0
https://github.com/wpengine/faustjs/pull/2386
https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3

Configurations

No configuration.

History

17 Sep 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 19:16

Updated : 2026-09-24 21:23

NVD link : CVE-2026-54239

Mitre link : CVE-2026-54239

CVE.ORG link : CVE-2026-54239

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-54239", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54239", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-18T17:24:07.874796Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wpengine", "product": "faustjs", "versions": [{"status": "affected", "version": "< 1.8.11"}]}]}], "published": "2026-09-17T19:16:50.047", "references": [{"url": "https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0", "source": "security-advisories@github.com"}, {"url": "https://github.com/wpengine/faustjs/pull/2386", "source": "security-advisories@github.com"}, {"url": "https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\\FaustWP\\Auth\\encrypt() and WPE\\FaustWP\\Auth\\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11."}], "lastModified": "2026-09-24T21:23:54.397", "sourceIdentifier": "security-advisories@github.com"}