WP Engine FaustWP Plugin up to 1.8.10 on WordPress Token Authentication functions.php WPE\FaustWP\Auth\encrypt/WPE\FaustWP\Auth\decrypt signature verification

Summaryinfo

A vulnerability was found in WP Engine FaustWP Plugin up to 1.8.10. It has been rated as critical. The affected element is the function WPE\FaustWP\Auth\encrypt/WPE\FaustWP\Auth\decrypt of the file plugins/faustwp/includes/auth/functions.php of the component Token Authentication. This manipulation causes signature verification. The identification of this vulnerability is CVE-2026-54239. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in WP Engine FaustWP Plugin up to 1.8.10. Affected by this vulnerability is the function WPE\FaustWP\Auth\encrypt/WPE\FaustWP\Auth\decrypt of the file plugins/faustwp/includes/auth/functions.php of the component Token Authentication. The manipulation with an unknown input leads to a signature verification vulnerability. The CWE definition for the vulnerability is CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54239 since 06/12/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:plugins/faustwp/includes/auth/functions.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.11 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• WP Engine

Name

• FaustWP Plugin

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion