rootpwn

critical · CVSS v3 8.8

CVE-2026-54239

The FaustWP WordPress plugin prior to version 1.8.11 fails to include the initialization vector in its token encryption HMAC validation. Thi

Overview

The FaustWP WordPress plugin prior to version 1.8.11 fails to include the initialization vector in its token encryption HMAC validation. This allows authenticated non-administrative users to manipulate the initialization vector and escalate their privileges to administrator. Consequently, attackers can gain full access to the WordPress REST API and execute arbitrary code.

Description

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

Impact

This vulnerability impacts the integrity and confidentiality of WordPress sites utilizing vulnerable versions of the FaustWP plugin. Non-administrative users can achieve privilege escalation to administrator status, leading to full system compromise, including plugin installation and arbitrary code execution. Organizations running affected toolkit versions face severe risk to their web application infrastructure.

Remediation

Update the FaustWP WordPress plugin to version 1.8.11 or later immediately. Review administrative accounts and REST API access logs for anomalous creation events or unauthorized configuration changes. Restrict unnecessary user registration and monitor low-privileged user activity closely.

Risk context

Rated as a critical severity vulnerability with a CVSS v3 score of 8.8, immediate patching is strongly recommended. Although EPSS data is not present, the potential for arbitrary code execution and full administrative takeover necessitates rapid mitigation.

Affected products

  • FaustWP WordPress plugin < 1.8.11
  • Faust.js headless WordPress toolkit

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
—

CVE-2026-54239 WordPress FaustWP Privilege Escalation Crypto Weakness Remote Code Execution

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis