A critical vulnerability in the FaustWP WordPress plugin allows authenticated non-administrators to escalate privileges to administrator status and execute arbitrary code.

The vulnerability exists due to improper cryptographic verification in the authentication token envelope, specifically within the encrypt and decrypt functions of the plugin. An authenticated user can manipulate the initialization vector to alter token contents, successfully bypassing authorization checks and gaining full administrative control over the WordPress instance.

The potential impact of this vulnerability is severe, as it enables full compromise of the WordPress environment. An attacker with standard user access can escalate privileges to gain administrative rights, leading to unauthorized data access, the installation of malicious plugins, and complete remote code execution. With a CVSS score of 8.8, this flaw represents a high-risk threat to the confidentiality, integrity, and availability of the affected business applications.

Immediate Action: Update the FaustWP WordPress plugin to version 1.8.11 or later immediately to resolve the cryptographic flaw.

Proactive Monitoring: Monitor WordPress audit logs for unexpected administrative account creation or unauthorized plugin installation attempts.

Compensating Controls: While no direct WAF rule can fix the underlying logic error, restricting access to the /generate endpoint for non-privileged users may reduce the attack surface.

Public Exploit Available: No.

Given the severity of this vulnerability and its potential for full system takeover, organizations using the FaustWP plugin must prioritize the update to version 1.8.11. Failure to patch will leave the application susceptible to privilege escalation and remote code execution by any authenticated user on the platform. Apply the update immediately to ensure the security of the WordPress environment.