Is CVE-2026-49062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49062 being exploited in the wild.

How severe is CVE-2026-49062?

High severity, with a CVSS score of 8.8, published 15 June 2026.

Is there a fix for CVE-2026-49062?

A patch was published on 2026-06-08: Version 1.8.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49062?

Check whether you run WP Engine Faust.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49062: WP Engine Faust.js authentication bypass in password recovery

CVE-2026-49062 · Severity: high · CVSS 8.8 · Published 2026-06-15

WP Engine Faust.js, a framework used to build headless WordPress sites, contains a security flaw in its authentication process. An attacker could exploit this vulnerability to bypass security checks and gain unauthorized access to user accounts, including administrative accounts, by manipulating the password recovery process. This could lead to a full takeover of the website, data theft, or service disruption.

Vendors: WP Engine.

Quick answers

Is CVE-2026-49062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49062 being exploited in the wild.
How severe is CVE-2026-49062?: High severity, with a CVSS score of 8.8, published 15 June 2026.
Which products and versions are affected?: WP Engine Faust.js <= 1.8.7.
Is there a fix for CVE-2026-49062?: A patch was published on 2026-06-08: Version 1.8.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49062?: Check whether you run WP Engine Faust.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability (CWE-288) exists in WP Engine Faust.js through version 1.8.7. The flaw resides in the password recovery mechanism, where an attacker can use an alternate path or channel to circumvent standard authentication requirements. While the CVSS vector indicates low privileges (PR:L) are required, the exploit allows for privilege escalation to higher-level accounts, potentially granting full administrative access. The vulnerability is remediated in version 1.8.8.

Affected products

WP Engine Faust.js <= 1.8.7

Timeline

2026-05-18: other: Reported by ParkHyunWoo
2026-06-08: patched: Version 1.8.8 released
2026-06-15: advisory: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/faustwp/vulnerability/wordpress-faust-js-plugin-1-8-7-broken-authentication-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.