Live › vulnerability › CVE-2026-113616
The LogixFast Auth WordPress plugin before 1.0.4 sends its password-reset one-time code to an email address supplied in the request rather than to the account owner's address. An unauthenticated attacker can reset any user's password, including an administrator's, and take over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the LogixFast Auth WordPress plugin before 1.0.4 that expose its password-reset flow. The exposure comes from the reset code being routed to an address the requester controls, so any site with the plugin active and reset enabled is in scope. Sites without the plugin, or running 1.0.4 or later, are not affected.
No product ranges from the sources yet.
logixfast-auth under wp-content/plugins/ if the version is not visible.1.0.4 or later (the sources state the fix is in 1.0.4 and later).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-113616")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.