CVE-2026-49062: Faust.js Auth Bypass Vulnerability

CVE-2026-49062 Overview

CVE-2026-49062 is an authentication bypass vulnerability in the WP Engine Faust.js plugin for WordPress, affecting all versions up to and including 1.8.7. The flaw resides in the plugin's password recovery flow, where an alternate path allows an attacker to bypass authentication controls [CWE-288]. An authenticated attacker with low privileges can exploit the weakness over the network without user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Exploitation enables account takeover through the password recovery path, granting attackers access to higher-privileged WordPress accounts and the data they control.

Affected Products

WP Engine Faust.js plugin (faustwp) versions through 1.8.7
WordPress sites with the Faust.js headless framework installed
Headless WordPress deployments relying on Faust.js authentication

Discovery Timeline

2026-06-15 - CVE-2026-49062 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49062

Vulnerability Analysis

Faust.js is a headless WordPress framework developed by WP Engine that bridges a Next.js front-end with a WordPress back-end. The vulnerability is classified as Authentication Bypass Using an Alternate Path or Channel [CWE-288]. The password recovery component exposes a code path that processes authentication-related operations without enforcing the same controls as the primary authentication flow.

An attacker who already holds a low-privileged WordPress account can invoke this alternate path to coerce a password reset or recovery action against another account. Because the bypass operates over standard HTTP requests to the plugin endpoints, no specialized tooling or user interaction is required. Once the recovery flow is abused, the attacker gains control of the target account and any privileges associated with it.

Root Cause

The root cause is missing or incomplete authentication enforcement on the password recovery channel within faustwp. The plugin trusts a secondary code path to perform recovery actions without re-validating the requester's identity or authorization against the target user. This violates the principle that every authentication-sensitive operation must be guarded by the same controls.

Attack Vector

The attack vector is network-based and requires low-level authenticated access. An attacker sends crafted requests to the Faust.js password recovery endpoint exposed by the plugin, leveraging the alternate path to trigger a recovery operation against a chosen account. See the Patchstack Vulnerability Report for additional technical context.

No public proof-of-concept code has been released, and no verified exploit samples are available at this time.

Detection Methods for CVE-2026-49062

Indicators of Compromise

Unexpected password reset or recovery events for administrator or editor accounts in WordPress audit logs.
HTTP requests targeting Faust.js password recovery endpoints originating from low-privileged user sessions.
Successful logins from new IP addresses or geolocations immediately following a password recovery event.
Modifications to user metadata or role assignments shortly after recovery flow activity.

Detection Strategies

Correlate WordPress authentication events with Faust.js plugin endpoint access to surface accounts that trigger recovery for users other than themselves.
Alert on password reset volume anomalies, particularly resets initiated by sessions belonging to subscriber or contributor-level accounts.
Inspect web server access logs for repeated POST requests to faustwp recovery routes across multiple target usernames.

Monitoring Recommendations

Enable verbose logging in WordPress for user account changes, password resets, and role modifications.
Forward web server and WordPress application logs to a centralized SIEM and retain them long enough to investigate post-exploitation activity.
Monitor outbound email logs for password recovery messages addressed to administrator accounts that did not initiate a reset.

How to Mitigate CVE-2026-49062

Immediate Actions Required

Update the Faust.js (faustwp) plugin to a version later than 1.8.7 as soon as a fixed release is available from WP Engine.
Audit all WordPress user accounts for unauthorized role changes, recent password resets, and unfamiliar email address updates.
Force a password reset for administrator and editor accounts and rotate any associated API keys or application passwords.
Restrict registration and reduce the privileges of any non-essential authenticated users on the site.

Patch Information

At the time of publication, the vulnerability affects Faust.js through version 1.8.7. Administrators should track the Patchstack Vulnerability Report and WP Engine's plugin changelog for the corrected release and apply it across all environments.

Workarounds

Disable the Faust.js plugin on production WordPress instances until a patched version is installed.
Place a web application firewall rule in front of the WordPress site to block requests to the plugin's password recovery endpoints from unauthenticated and low-privileged sessions.
Enforce multi-factor authentication on all administrator and editor accounts so that a recovered password alone is insufficient for full account takeover.

bash

# Configuration example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate faustwp
wp plugin status faustwp