Faust.js is a headless WordPress toolkit. In versions of the FaustWP plugin before 1.8.11, the authentication mechanism for tokens only verifies the ciphertext with HMAC but excludes the 16-byte initialization vector (IV) from the HMAC calculation in the encrypt() and decrypt() functions. Because the IV is unauthenticated, a logged-in non-administrator who obtains an authorization code from the GET /generate endpoint can modify the IV to alter the decrypted token's type and user ID while keeping the HMAC valid. This manipulation allows escalation to an administrator token, granting full WordPress REST API access, the ability to create administrator accounts, install plugins, and execute arbitrary code. The vulnerability is addressed in version 1.8.11 of the FaustWP plugin.

An attacker with a logged-in non-administrator account can escalate privileges to administrator by manipulating the token's initialization vector, bypassing authentication checks. This leads to full REST API access, administrator account creation, plugin installation, and arbitrary code execution within the WordPress environment, posing a critical risk to site integrity and security.

Upgrade the FaustWP WordPress plugin to version 1.8.11 or later, where the issue is fixed by including the initialization vector in the HMAC verification. No other mitigations are indicated by the vendor advisory.