CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...