---
id: "CVE-2026-113616"
kind: "vulnerability"
aliases: ["CVE-2026-113616"]
title: "LogixFast Auth WordPress plugin: password reset code sent to attacker address"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["logixfast-auth", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.0.4-or-later"]
published_at: "2026-10-29T06:17:18+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113616", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# LogixFast Auth WordPress plugin: password reset code sent to attacker address

The LogixFast Auth WordPress plugin before 1.0.4 sends its password-reset one-time code to an email address supplied in the request rather than to the account owner's address. An unauthenticated attacker can reset any user's password, including an administrator's, and take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the LogixFast Auth plugin in the WordPress admin under Plugins; unknown whether a file or option path is given in the sources.
- Look for the plugin folder named `logixfast-auth` under `wp-content/plugins/` if the version is not visible.

## Fix

- LogixFast Auth plugin: move to `1.0.4` or later (the sources state the fix is in 1.0.4 and later).

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113616

## From the sources

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_