CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
A logged-in non-admin can modify the initialization vector to forge an administrator token, gaining full site control and code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54239?
CVE-2026-54239 is a high-severity authentication bypass vulnerability in wpengine faustjs, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.
Which versions are affected by CVE-2026-54239?
How do I fix CVE-2026-54239?
No fix has been published for CVE-2026-54239 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-54239 being exploited?
There is no known exploitation of CVE-2026-54239 in the wild and no public exploit code.
Sources
Also known as GHSA-q6pm-r77q-qcv3.