The WordPress Faust.js plugin contains an authentication bypass that allows an attacker to use the password recovery channel to reset a user’s password without proper authorization. By triggering this flaw, an adversary can gain administrative access to the website, compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑288, reflecting an improper enforcement of authorization controls.

Sites running WP Engine’s Faust.js plugin through version 1.8.7 are affected. Any WordPress installation that has not applied the 1.8.8 upgrade or later is vulnerable. The plugin is included in /wp-content/plugins/faustjs or similar paths and is commonly deployed on WordPress sites managed by WP Engine or self‑hosted WordPress sites.

The CVSS score of 8.8 indicates high severity authentication bypass. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploits yet. However, because the attack can be launched from the public password reset form, exploitation is straightforward for an attacker who can target the site’s recovery endpoint; the likely attack vector is a web request to the password recovery page.