{"id":"CVE-2026-54239","summary":"FaustWP  — Authentication Bypass via Initialization Vector Modification in Token Envelope","details":"Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\\FaustWP\\Auth\\encrypt() and WPE\\FaustWP\\Auth\\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.","aliases":["GHSA-q6pm-r77q-qcv3"],"modified":"2026-09-20T11:30:20.744248091Z","published":"2026-09-17T18:25:36.503Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54239.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-345","CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54239.json"},{"type":"ADVISORY","url":"https://github.com/wpengine/faustjs/security/advisories/GHSA-q6pm-r77q-qcv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54239"},{"type":"FIX","url":"https://github.com/wpengine/faustjs/commit/cda00de7290f9b178cb1652d30b4cdf5bb8688d0"},{"type":"FIX","url":"https://github.com/wpengine/faustjs/pull/2386"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wpengine/faustjs","events":[{"introduced":"0"},{"fixed":"cda00de7290f9b178cb1652d30b4cdf5bb8688d0"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.8.11"}]}}],"versions":["canary","@faustwp/wordpress-plugin@1.8.1","@faustwp/core@3.3.4","@faustwp/cli@3.3.4","@faustwp/blocks@6.1.6","@faustwp/block-editor-utils@0.3.6","@faustwp/cli@3.3.3","@faustwp/core@3.3.2","@faustwp/core@3.3.1","@faustwp/cli@3.3.1","@faustwp/blocks@6.1.5","@faustwp/block-editor-utils@0.3.5","@faustwp/core@3.3.0","@faustwp/core@3.2.6","@faustwp/blocks@6.1.4","@faustwp/cli@3.2.5","@faustwp/core@3.2.4","@faustwp/cli@3.2.4","@faustwp/blocks@6.1.3","@faustwp/block-editor-utils@0.3.4","@faustwp/wordpress-plugin@1.8.4","@faustwp/core@3.2.3","@faustwp/cli@3.2.3","@faustwp/blocks@6.1.2","@faustwp/block-editor-utils@0.3.3","@faustwp/core@3.2.2","@faustwp/cli@3.2.2","@faustwp/blocks@6.1.1","@faustwp/block-editor-utils@0.3.2","@faustwp/wordpress-plugin@1.8.3","@faustwp/wordpress-plugin@1.8.2","@faustwp/wordpress-plugin@\"1.8.2\"","@faustwp/wordpress-plugin@1.8.0","\"1.8.0\"","@faustwp/wordpress-plugin@1.7.5","\"1.7.5\"","@faustwp/wordpress-plugin@1.7.4","@faustwp/wordpress-plugin@1.7.3","@faustwp/wordpress-plugin@1.7.2","@faustwp/core@3.2.1","@faustwp/cli@3.2.1","@faustwp/blocks@6.1.0","@faustwp/block-editor-utils@0.3.1","@faustwp/wordpress-plugin@1.7.1","@faustwp/wordpress-plugin@1.7.0","@faustwp/core@3.2.0","@faustwp/wordpress-plugin@1.6.0","@faustwp/experimental-app-router@0.6.0","@faustwp/blocks@6.0.0","@faustwp/experimental-app-router@0.5.0","@faustwp/cli@3.1.1","@faustwp/blocks@5.0.0","@faustwp/wordpress-plugin@1.5.0","@faustwp/wordpress-plugin@1.4.1","@faustwp/wordpress-plugin@1.4.0","@faustwp/experimental-app-router@0.4.0","@faustwp/core@3.1.0","@faustwp/cli@3.1.0","@faustwp/blocks@4.1.0","@faustwp/block-editor-utils@0.3.0","@faustjs/react@0.16.0","@faustjs/next@0.16.0","@faustwp/wordpress-plugin@1.3.2","@faustwp/core@3.0.3","@faustwp/block-editor-utils@0.2.1","@faustwp/wordpress-plugin@1.3.1","@faustwp/wordpress-plugin@1.3.0","@faustwp/cli@3.0.2","@faustjs/next@0.15.14","@faustwp/wordpress-plugin@1.2.3","@faustwp/experimental-app-router@0.3.1","@faustwp/core@3.0.1","@faustwp/cli@3.0.1","@faustwp/wordpress-plugin@1.2.2","@faustwp/experimental-app-router@0.3.0","@faustwp/core@3.0.0","@faustwp/cli@3.0.0","@faustwp/blocks@4.0.0","@faustwp/block-editor-utils@0.2.0","@faustwp/blocks@3.0.0","@faustwp/block-support-example@0.2.0","@faustwp/wordpress-plugin@1.2.1","@faustwp/core@2.1.2","@faustwp/core@2.1.1","@faustjs/react@0.15.13","@faustjs/next@0.15.13","@faustjs/core@0.15.13","@faustwp/core@2.1.0","@faustwp/wordpress-plugin@1.2.0","@faustwp/core@2.0.0","@faustwp/cli@2.0.0","@faustwp/block-editor-utils@0.1.0","@faustwp/wordpress-plugin@1.1.2","@faustwp/experimental-app-router@0.2.2","@faustwp/cli@1.2.1","@faustwp/experimental-app-router@0.2.1","@faustwp/experimental-app-router@0.2.0","@faustwp/wordpress-plugin@1.1.1","@faustwp/wordpress-plugin@1.1.0","@faustwp/core@1.2.0","@faustwp/cli@1.2.0","@faustwp/block-editor-utils@0.0.5","@faustwp/cli@1.1.4","@faustwp/block-support-example@0.1.0","@faustwp/experimental-app-router@0.1.0","@faustwp/block-editor-utils@0.0.4","@faustwp/wordpress-plugin@1.0.4","@faustwp/experimental-app-router@0.0.4","@faustwp/cli@1.1.3","@faustwp/block-editor-utils@0.0.3","@faustwp/experimental-app-router@0.0.3","@faustwp/core@1.1.2","@faustwp/experimental-app-router@0.0.2","@faustwp/core@1.1.1","@faustwp/cli@1.1.1","@faustwp/block-editor-utils@0.0.2","@faustjs/next@0.15.12","@faustwp/experimental-app-router@0.0.1","@faustwp/block-editor-utils@0.0.1","@faustwp/wordpress-plugin@1.0.3","@faustwp/wordpress-plugin@1.0.2","@faustwp/core@1.1.0","@faustwp/blocks@2.0.0","@faustwp/wordpress-plugin@1.0.1","@faustwp/core@1.0.3","@faustwp/blocks@1.2.0","@faustwp/core@1.0.2","@faustwp/blocks@1.1.0","@faustwp/core@1.0.1","@faustwp/cli@1.0.1","@faustwp/wordpress-plugin@1.0.0","@faustwp/core@1.0.0","@faustwp/cli@1.0.0","@faustwp/blocks@1.0.0","@faustjs/next@0.15.11","@faustwp/wordpress-plugin@0.8.7","@faustwp/core@0.2.13","@faustwp/cli@0.2.13","@faustwp/blocks@0.3.1","@faustwp/wordpress-plugin@0.8.6","@faustwp/cli@0.2.12","@faustwp/core@0.2.11","@faustwp/wordpress-plugin@0.8.5","@faustwp/getting-started-example@0.1.0","@faustwp/core@0.2.10","@faustwp/cli@0.2.10","@faustwp/blocks@0.3.0","@faustjs/react@0.15.10","@faustjs/next@0.15.10","@faustjs/next-headless-getting-started@0.1.0","@faustjs/core@0.15.10","@faustwp/core@0.2.9","@faustwp/core@0.2.8","@faustwp/blocks@0.2.1","@faustwp/wordpress-plugin@0.8.4","@faustwp/wordpress-plugin@0.8.3","@faustwp/core@0.2.7","@faustwp/cli@0.2.7","@faustwp/blocks@0.2.0","@faustwp/core@0.2.6","@faustwp/core@0.2.5","@faustwp/blocks@0.1.1","@faustwp/core@0.2.4","@faustwp/core@0.2.3","@faustwp/core@0.2.2","@faustwp/cli@0.2.2","@faustwp/core@0.2.1","@faustwp/blocks@0.1.0","@faustwp/wordpress-plugin@0.8.1","@faustwp/core@0.2.0","@faustwp/cli@0.2.0","@faustwp/cli@0.1.6","@faustwp/core@0.1.5","@faustwp/cli@0.1.5","@faustwp/cli@0.1.4","@faustwp/core@0.1.3","@faustwp/cli@0.1.3","@faustwp/core@0.1.2","@faustwp/cli@0.1.2","plugin/faustwp/v0.8.0","@faustwp/core@0.1.1","@faustwp/cli@0.1.1","@faustwp/core@0.1.0","@faustwp/cli@0.1.0","@faustjs/next@0.15.9","plugin/faustwp/v0.7.11","@faustjs/next@0.15.8","plugin/faustwp/v0.7.10","@faustjs/react@0.15.7","@faustjs/next@0.15.7","@faustjs/core@0.15.7","faust-nx@0.0.1","faust-nx-getting-started@0.1.0","plugin/faustwp/v0.7.9","plugin/faustwp/v0.7.8","@faustjs/react@0.15.6","@faustjs/next@0.15.6","@faustjs/core@0.15.6","plugin/faustwp/v0.7.7","plugin/faustwp/v0.7.6","@faustjs/next@0.15.5","plugin/faustwp/v0.7.5","@faustjs/next@0.15.4","@faustjs/core@0.15.4","plugin/faustwp/v0.7.4","@faustjs/next@0.15.3","plugin/faustwp/v0.7.3","@faustjs/core@0.15.2","@faustjs/react@0.15.1","@faustjs/next@0.15.1","@faustjs/core@0.15.1","@faustjs/react@0.15.0","@faustjs/next@0.15.0","@faustjs/core@0.15.0","plugin/faustwp/v0.7.1","@faustjs/core@0.14.1","plugin/faustwp/v0.7.0","@faustjs/react@0.14.0","@faustjs/next@0.14.0","@faustjs/core@0.14.0","@faustjs/react@0.13.1","@faustjs/next@0.13.1","@faustjs/core@0.13.1","@faustjs/next@0.13.0","@faustjs/react@0.12.4","@faustjs/next@0.12.4","@faustjs/core@0.12.4","@faustjs/next@0.12.2","@faustjs/next@0.12.3","@faustjs/core@0.12.3","package/core/0.11.0","plugin/wpe-headless/0.5.5","plugin/wpe-headless/0.5.4","plugin/wpe-headless/0.5.3","package/headless/0.6.3","plugin/wpe-headless/0.5.2","package/headless/0.6.2","plugin/wpe-headless/0.5.1","package/headless/0.6.1","plugin/wpe-headless/0.5.0","plugin/wpe-headless/0.4.1","plugin/wpe-headless/0.4.0","plugin/wpe-headless/0.3.2-alpha.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54239.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}