Threats affecting pkg:github/wpengine/faustjs

CVE-2026-54239 is a high-severity vulnerability in the FaustWP WordPress plugin, part of the Faust.js headless WordPress toolkit. Versions prior to 1.8.11 improperly authenticate token data by excluding the initialization vector from the HMAC, allowing a logged-in non-administrator to manipulate tokens. This manipulation can escalate privileges to administrator level, enabling full REST API access, administrator account creation, plugin installation, and arbitrary code execution. The issue is fixed in version 1.8.11.