Skip to content
Heist/ feed
Back to feed
High

FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

Type: advisorySources: OSV

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-54239
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 17:18 UTC · Revision 1

Source evidence

FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

core-osv · Original source

Published 17 Sept 2026, 18:25 UTC

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

osv:CVE-2026-54239
Complete source record
{
  "id": "cdf2707b354f564a1a1389b6babdf8b14192f277a28f95ed54ac84e1cfe6f524",
  "url": "https://osv.dev/vulnerability/CVE-2026-54239",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope",
    "summary": "Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\\FaustWP\\Auth\\encrypt() and WPE\\FaustWP\\Auth\\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.",
    "evidence": "osv:CVE-2026-54239",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-54239",
      "aliases": [
        "CVE-2026-54239",
        "GHSA-q6pm-r77q-qcv3"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/wpengine/faustjs",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ce8bcff5e4f4fb49479a33588cd940a455ff1011"
                },
                {
                  "fixed": "cda00de7290f9b178cb1652d30b4cdf5bb8688d0"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.8.11"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "cda00de7290f9b178cb1652d30b4cdf5bb8688d0"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "canary",
            "@faustwp/wordpress-plugin@1.8.1",
            "@faustwp/core@3.3.4",
            "@faustwp/cli@3.3.4",
            "@faustwp/blocks@6.1.6",
            "@faustwp/block-editor-utils@0.3.6",
            "@faustwp/cli@3.3.3",
            "@faustwp/core@3.3.2",
            "@faustwp/core@3.3.1",
            "@faustwp/cli@3.3.1",
            "@faustwp/blocks@6.1.5",
            "@faustwp/block-editor-utils@0.3.5",
            "@faustwp/core@3.3.0",
            "@faustwp/core@3.2.6",
            "@faustwp/blocks@6.1.4",
            "@faustwp/cli@3.2.5",
            "@faustwp/core@3.2.4",
            "@faustwp/cli@3.2.4",
            "@faustwp/blocks@6.1.3",
            "@faustwp/block-editor-utils@0.3.4",
            "@faustwp/wordpress-plugin@1.8.4",
            "@faustwp/core@3.2.3",
            "@faustwp/cli@3.2.3",
            "@faustwp/blocks@6.1.2",
            "@faustwp/block-editor-utils@0.3.3",
            "@faustwp/core@3.2.2",
            "@faustwp/cli@3.2.2",
            "@faustwp/blocks@6.1.1",
            "@faustwp/block-editor-utils@0.3.2",
            "@faustwp/wordpress-plugin@1.8.3",
            "@faustwp/wordpress-plugin@1.8.2",
            "@faustwp/wordpress-plugin@\"1.8.2\"",
            "@faustwp/wordpress-plugin@1.8.0",
            "\"1.8.0\"",
            "@faustwp/wordpress-plugin@1.7.5",
            "\"1.7.5\"",
            "@faustwp/wordpress-plugin@1.7.4",
            "@faustwp/wordpress-plugin@1.7.3",
            "@faustwp/wordpress-plugin@1.7.2",
            "@faustwp/core@3.2.1",
            "@faustwp/cli@3.2.1",
            "@faustwp/blocks@6.1.0",
            "@faustwp/block-editor-utils@0.3.1",
            "@faustwp/wordpress-plugin@1.7.1",
            "@faustwp/wordpress-plugin@1.7.0",
            "@faustwp/core@3.2.0",
            "@faustwp/wordpress-plugin@1.6.0",
            "@faustwp/experimental-app-router@0.6.0",
            "@faustwp/blocks@6.0.0",
            "@faustwp/experimental-app-router@0.5.0",
            "@faustwp/cli@3.1.1",
            "@faustwp/blocks@5.0.0",
            "@faustwp/wordpress-plugin@1.5.0",
            "@faustwp/wordpress-plugin@1.4.1",
            "@faustwp/wordpress-plugin@1.4.0",
            "@faustwp/experimental-app-router@0.4.0",
            "@faustwp/core@3.1.0",
            "@faustwp/cli@3.1.0",
            "@faustwp/blocks@4.1.0",
            "@faustwp/block-editor-utils@0.3.0",
            "@faustjs/react@0.16.0",
            "@faustjs/next@0.16.0",
            "@faustwp/wordpress-plugin@1.3.2",
            "@faustwp/core@3.0.3",
            "@faustwp/block-editor-utils@0.2.1",
            "@faustwp/wordpress-plugin@1.3.1",
            "@faustwp/wordpress-plugin@1.3.0",
            "@faustwp/cli@3.0.2",
            "@faustjs/next@0.15.14",
            "@faustwp/wordpress-plugin@1.2.3",
            "@faustwp/experimental-app-router@0.3.1",
            "@faustwp/core@3.0.1",
            "@faustwp/cli@3.0.1",
            "@faustwp/wordpress-plugin@1.2.2",
            "@faustwp/experimental-app-router@0.3.0",
            "@faustwp/core@3.0.0",
            "@faustwp/cli@3.0.0",
            "@faustwp/blocks@4.0.0",
            "@faustwp/block-editor-utils@0.2.0",
            "@faustwp/blocks@3.0.0",
            "@faustwp/block-support-example@0.2.0",
            "@faustwp/wordpress-plugin@1.2.1",
            "@faustwp/core@2.1.2",
            "@faustwp/core@2.1.1",
            "@faustjs/react@0.15.13",
            "@faustjs/next@0.15.13",
            "@faustjs/core@0.15.13",
            "@faustwp/core@2.1.0",
            "@faustwp/wordpress-plugin@1.2.0",
            "@faustwp/core@2.0.0",
            "@faustwp/cli@2.0.0",
            "@faustwp/block-editor-utils@0.1.0",
            "@faustwp/wordpress-plugin@1.1.2",
            "@faustwp/experimental-app-router@0.2.2",
            "@faustwp/cli@1.2.1",
            "@faustwp/experimental-app-router@0.2.1",
            "@faustwp/experimental-app-router@0.2.0",
            "@faustwp/wordpress-plugin@1.1.1",
            "@faustwp/wordpress-plugin@1.1.0",
            "@faustwp/core@1.2.0",
            "@faustwp/cli@1.2.0",
            "@faustwp/block-editor-utils@0.0.5",
            "@faustwp/cli@1.1.4",
            "@faustwp/block-support-example@0.1.0",
            "@faustwp/experimental-app-router@0.1.0",
            "@faustwp/block-editor-utils@0.0.4",
            "@faustwp/wordpress-plugin@1.0.4",
            "@faustwp/experimental-app-router@0.0.4",
            "@faustwp/cli@1.1.3",
            "@faustwp/block-editor-utils@0.0.3",
            "@faustwp/experimental-app-router@0.0.3",
            "@faustwp/core@1.1.2",
            "@faustwp/experimental-app-router@0.0.2",
            "@faustwp/core@1.1.1",
            "@faustwp/cli@1.1.1",
            "@faustwp/block-editor-utils@0.0.2",
            "@faustjs/next@0.15.12",
            "@faustwp/experimental-app-router@0.0.1",
            "@faustwp/block-editor-utils@0.0.1",
            "@faustwp/wordpress-plugin@1.0.3",
            "@faustwp/wordpress-plugin@1.0.2",
            "@faustwp/core@1.1.0",
            "@faustwp/blocks@2.0.0",
            "@faustwp/wordpress-plugin@1.0.1",
            "@faustwp/core@1.0.3",
            "@faustwp/blocks@1.2.0",
            "@faustwp/core@1.0.2",
            "@faustwp/blocks@1.1.0",
            "@faustwp/core@1.0.1",
            "@faustwp/cli@1.0.1",
            "@faustwp/wordpress-plugin@1.0.0",
            "@faustwp/core@1.0.0",
            "@faustwp/cli@1.0.0",
            "@faustwp/blocks@1.0.0",
            "@faustjs/next@0.15.11",
            "@faustwp/wordpress-plugin@0.8.7",
            "@faustwp/core@0.2.13",
            "@faustwp/cli@0.2.13",
            "@faustwp/blocks@0.3.1",
            "@faustwp/wordpress-plugin@0.8.6",
            "@faustwp/cli@0.2.12",
            "@faustwp/core@0.2.11",
            "@faustwp/wordpress-plugin@0.8.5",
            "@faustwp/getting-started-example@0.1.0",
            "@faustwp/core@0.2.10",
            "@faustwp/cli@0.2.10",
            "@faustwp/blocks@0.3.0",
            "@faustjs/react@0.15.10",
            "@faustjs/next@0.15.10",
            "@faustjs/next-headless-getting-started@0.1.0",
            "@faustjs/core@0.15.10",
            "@faustwp/core@0.2.9",
            "@faustwp/core@0.2.8",
            "@faustwp/blocks@0.2.1",
            "@faustwp/wordpress-plugin@0.8.4",
            "@faustwp/wordpress-plugin@0.8.3",
            "@faustwp/core@0.2.7",
            "@faustwp/cli@0.2.7",
            "@faustwp/blocks@0.2.0",
            "@faustwp/core@0.2.6",
            "@faustwp/core@0.2.5",
            "@faustwp/blocks@0.1.1",
            "@faustwp/core@0.2.4",
            "@faustwp/core@0.2.3",
            "@faustwp/core@0.2.2",
            "@faustwp/cli@0.2.2",
            "@faustwp/core@0.2.1",
            "@faustwp/blocks@0.1.0",
            "@faustwp/wordpress-plugin@0.8.1",
            "@faustwp/core@0.2.0",
            "@faustwp/cli@0.2.0",
            "@faustwp/cli@0.1.6",
            "@faustwp/core@0.1.5",
            "@faustwp/cli@0.1.5",
            "@faustwp/cli@0.1.4",
            "@faustwp/core@0.1.3",
            "@faustwp/cli@0.1.3",
            "@faustwp/core@0.1.2",
            "@faustwp/cli@0.1.2",
            "plugin/faustwp/v0.8.0",
            "@faustwp/core@0.1.1",
            "@faustwp/cli@0.1.1",
            "@faustwp/core@0.1.0",
            "@faustwp/cli@0.1.0",
            "@faustjs/next@0.15.9",
            "plugin/faustwp/v0.7.11",
            "@faustjs/next@0.15.8",
            "plugin/faustwp/v0.7.10",
            "@faustjs/react@0.15.7",
            "@faustjs/next@0.15.7",
            "@faustjs/core@0.15.7",
            "faust-nx@0.0.1",
            "faust-nx-getting-started@0.1.0",
            "plugin/faustwp/v0.7.9",
            "plugin/faustwp/v0.7.8",
            "@faustjs/react@0.15.6",
            "@faustjs/next@0.15.6",
            "@faustjs/core@0.15.6",
            "plugin/faustwp/v0.7.7",
            "plugin/faustwp/v0.7.6",
            "@faustjs/next@0.15.5",
            "plugin/faustwp/v0.7.5",
            "@faustjs/next@0.15.4",
            "@faustjs/core@0.15.4",
            "plugin/faustwp/v0.7.4",
            "@faustjs/next@0.15.3",
            "plugin/faustwp/v0.7.3",
            "@faustjs/core@0.15.2",
            "@faustjs/react@0.15.1",
            "@faustjs/next@0.15.1",
            "@faustjs/core@0.15.1",
            "@faustjs/react@0.15.0",
            "@faustjs/next@0.15.0",
            "@faustjs/core@0.15.0",
            "plugin/faustwp/v0.7.1",
            "@faustjs/core@0.14.1",
            "plugin/faustwp/v0.7.0",
            "@faustjs/react@0.14.0",
            "@faustjs/next@0.14.0",
            "@faustjs/core@0.14.0",
            "@faustjs/react@0.13.1",
            "@faustjs/next@0.13.1",
            "@faustjs/core@0.13.1",
            "@faustjs/next@0.13.0",
            "@faustjs/react@0.12.4",
            "@faustjs/next@0.12.4",
            "@faustjs/core@0.12.4",
            "@faustjs/next@0.12.2",
            "@faustjs/next@0.12.3",
            "@faustjs/core@0.12.3",
            "package/core/0.11.0",
            "plugin/wpe-headless/0.5.5",
            "plugin/wpe-headless/0.5.4",
            "plugin/wpe-headless/0.5.3",
            "package/headless/0.6.3",
            "plugin/wpe-headless/0.5.2",
            "package/headless/0.6.2",
            "plugin/wpe-headless/0.5.1",
            "package/headless/0.6.1",
            "plugin/wpe-headless/0.5.0",
            "plugin/wpe-headless/0.4.1",
            "plugin/wpe-headless/0.4.0",
            "plugin/wpe-headless/0.3.2-alpha.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54239.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.694128176Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54239.json",
        "https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54239",
        "https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0",
        "https://github.com/wpengine/faustjs/pull/2386"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-345",
          "CWE-639"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54239.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-54239",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505256,
  "published_at": "2026-09-17T18:25:36.503+00:00"
}