Skip to content
OpenAdvisories

Product · wpengine

faustjs

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-54239

    FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

    Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\dec…

    wpengine faustjs Web / CMS