This vulnerability in WP Engine Faust.js allows an attacker with some privileges to bypass authentication by exploiting an alternate path or channel in the password recovery process. The issue affects all versions before 1.8.8. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, leading to high confidentiality, integrity, and availability impacts. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to bypass authentication controls and potentially gain unauthorized access to user accounts or administrative functions via the password recovery feature. This could lead to full compromise of confidentiality, integrity, and availability of affected systems running vulnerable versions of Faust.js.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password recovery functionality where possible and monitor for suspicious activity related to authentication bypass attempts. Avoid deploying affected versions in sensitive environments.