CVE-2026-113616: LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LogixFast Authto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
Any account in an affected installation can be targeted, including administrator accounts.
Does an attacker need to be authenticated or know the victim's mailbox contents?
No. The issue can be exploited without authentication because the reset code is sent to the email address supplied by the attacker rather than the resolved account's email address.
How can I determine whether my site is affected?
Check whether the LogixFast Auth WordPress plugin version is earlier than 1.0.4. Affected behavior occurs when a password-reset request for an account causes the one-time code to be delivered to the request-supplied email address instead of that account's configured email address.