CVE-2026-49062: WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability

Synopsis

An authentication bypass vulnerability affects the WP Engine Faust.js WordPress plugin at version 1.8.7 and earlier. The flaw is reachable over the network and requires only a low-privilege account, meaning an attacker who can log in with any standard user credentials can exploit a password recovery channel to bypass authentication controls entirely. Successful exploitation gives the attacker full read, write, and availability control over the affected installation. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; local or physical access is not required.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrator credentials, but some valid account on the target site is needed.

• Victim interactionNot required

  No action from any other user or administrator is needed to complete the attack.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental requirements to satisfy.

Blast Radius

• Reads any content accessible to an authenticated session, including private posts, user data, and stored credentials or tokens.
• Modifies site content, user records, plugin settings, or any persisted data writable by an authenticated user.
• Disrupts site availability by altering or deleting critical configuration, content, or user account data.
• Effective authentication bypass means the attacker can escalate the scope of damage across the entire WordPress installation without further barriers.