FaustWP WordPress Plugin CVE-2026-54239

Requires FaustWP plugin version < 1.8.11 installed and active on a headless WordPress site with the auth/token flow enabled. The attacker must be a logged-in non-administrator (e.g. Subscriber) able to reach GET /generate to obtain a valid authorization-code token envelope - this is the core prerequisite (PR:L). No administrator privileges and no victim user interaction are needed; exploitation is network-reachable and deterministic once an account and authorization code are obtained. Limiting factors: an existing low-privilege account (or open registration) and access to the token-generation endpoint; sites not running the vulnerable FaustWP versions or without the headless auth flow are unaffected.

This is a genuine high-priority vulnerability, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is well-supported by the technical evidence: a low-privileged authenticated WordPress user (e.g. Subscriber) can deterministically forge an Administrator access token through a classic AES-CBC IV bit-flipping attack, because the FaustWP token envelope HMAC covers only the ciphertext and not the 16-byte IV. The vendor-confirmed commit (cda00de) and GHSA-q6pm-r77q-qcv3 make the root cause and impact unambiguous, and the shipped regression test demonstrates the exact byte manipulations (IV[1]^= 'c'^'t' to turn 'ac'→'at', IV[3]^= '2'^'1' to change the user id) that yield a valid Administrator token - a reliable, non-probabilistic exploit primitive with no cryptographic guesswork. Weighing signals: no CISA KEV entry and no EPSS score were provided, so there is no evidence of active in-the-wild exploitation, and no packaged public exploit is listed - but the advisory and test code together provide effectively a working recipe, meaning weaponization is trivial for a competent attacker. The main risk-limiting factor is the PR:L prerequisite (attacker needs an existing low-privilege account and reachable /generate endpoint) and the relatively narrow deployment footprint of the FaustWP plugin. Net: low real-world exploitation evidence today, but high exploitability and catastrophic impact (full site takeover / RCE) where the vulnerable plugin is installed - patch to 1.8.11 promptly.

An attacker registers or already holds a non-administrator WordPress account (e.g. Subscriber) on a site running FaustWP < 1.8.11, then calls GET /generate to obtain a valid authorization-code token envelope. Because the HMAC does not cover the IV, they XOR chosen bytes into the IV to flip the CBC-decrypted first plaintext block from 'ac|2|<exp>' to 'at|1|<exp>', producing a valid Administrator access token while the HMAC still verifies. No public packaged exploit is listed, but the vendor's own regression test spells out the exact bit-flip mechanics, so weaponization is straightforward and grants full REST API access, admin-account creation, plugin installation, and arbitrary code execution.