{"id":"CVE-2026-113616","kind":"vulnerability","aliases":["CVE-2026-113616"],"related":[],"title":"LogixFast Auth WordPress plugin: password reset code sent to attacker address","description":"The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.","summary":"The LogixFast Auth WordPress plugin before 1.0.4 sends its password-reset one-time code to an email address supplied in the request rather than to the account owner's address. An unauthenticated attacker can reset any user's password, including an administrator's, and take over the account.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["logixfast-auth","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.0.4-or-later"],"how_to_check":"- Check the installed version of the LogixFast Auth plugin in the WordPress admin under Plugins; unknown whether a file or option path is given in the sources.\n- Look for the plugin folder named `logixfast-auth` under `wp-content/plugins/` if the version is not visible.","fix":"- LogixFast Auth plugin: move to `1.0.4` or later (the sources state the fix is in 1.0.4 and later).","status":"open","published_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:51+00:00","updated_at":"2026-10-29T06:54:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T06:54:51Z","model":"claude-haiku-5-5","output":{"fix":"- LogixFast Auth plugin: move to `1.0.4` or later (the sources state the fix is in 1.0.4 and later).","reach":"internet","title":"LogixFast Auth WordPress plugin: password reset code sent to attacker address","impact":"high","summary":"The LogixFast Auth WordPress plugin before 1.0.4 sends its password-reset one-time code to an email address supplied in the request rather than to the account owner's address. An unauthenticated attacker can reset any user's password, including an administrator's, and take over the account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","logixfast-auth","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over any account, including administrators, without credentials","analyst_note":"Confirm the affected version range and whether the reset flow is enabled by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113616.","how_to_check":"- Check the installed version of the LogixFast Auth plugin in the WordPress admin under Plugins; unknown whether a file or option path is given in the sources.\n- Look for the plugin folder named `logixfast-auth` under `wp-content/plugins/` if the version is not visible.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.0.4-or-later"],"who_is_affected":"Sites running the LogixFast Auth WordPress plugin before 1.0.4 that expose its password-reset flow. The exposure comes from the reset code being routed to an address the requester controls, so any site with the plugin active and reset enabled is in scope. Sites without the plugin, or running 1.0.4 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4122,"output_tokens":659,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113616':14A,17A '-2026':13A,16A '1.0.4':32B,82C 'account':54B,75B,97C,129C 'address':11A,45B,57B,101C,106C 'administr':69B,123C 'allow':112C 'attack':10A,60B,114C 'auth':2A,20B,28B,78C 'code':7A,41B,93C 'cve':12A,15A 'deliv':85C 'email':44B,100C 'host':24B 'includ':67B,121C 'instead':111C 'logixfast':1A,19B,27B,77C 'logixfast-auth':18B 'mail':102C 'one':39B,91C 'one-tim':38B,90C 'owner':55B 'packag':21B 'password':5A,36B,66B,88C,120C 'password-reset':35B,87C 'plugin':4A,30B,80C 'rather':50B 'request':49B,110C 'reset':6A,37B,62B,89C,116C 'resolv':96C 'self':23B 'self-host':22B 'send':33B 'sent':8A 'suppli':46B,107C 'take':72B,126C 'time':40B,92C 'unauthent':59B,113C 'user':64B,118C 'wordpress':3A,25B,29B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the LogixFast Auth WordPress plugin before 1.0.4 that expose its password-reset flow. The exposure comes from the reset code being routed to an address the requester controls, so any site with the plugin active and reset enabled is in scope. Sites without the plugin, or running 1.0.4 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113616","severity":null,"published_at":"2026-10-29T06:17:18+00:00","modified_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}