Executive brief
FaustWP is a WordPress plugin that manages authentication tokens for headless WordPress sites. Prior to version 1.8.11, the plugin's token validation logic excluded the initialization vector (a cryptographic component) from its integrity check. An attacker with a logged-in non-administrator account could modify tokens to gain full administrator access, create new admin accounts, install plugins, and execute arbitrary code on the WordPress site.
Technical details
The vulnerability is a cryptographic authentication bypass in CBC mode encryption. The FaustWP plugin's encrypt() and decrypt() functions in plugins/faustwp/includes/auth/functions.php authenticate only the ciphertext portion of the token envelope via HMAC, excluding the 16-byte initialization vector (IV) from the integrity check. A logged-in non-administrator who obtains an authorization code via GET /generate can craft a modified IV that changes the decrypted token type and user identifier while keeping the HMAC valid, due to the IV's exclusion from HMAC computation. This enables privilege escalation to Administrator with full REST API access. The fix, released in version 1.8.11, includes the IV in the HMAC input during both encryption and decryption.
Affected products
- WPEngine FaustWP prior to 1.8.11
Timeline
- 2026-09-17: disclosed
- 2026-06-03: patched: Fix merged in repository version 1.8.11