CVE-2026-113616
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code…
- Risk score
- 65/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The LogixFast Auth WordPress plugin before 1.0.4 has a vulnerability that allows unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
- Affected
- {'products': ['LogixFast Auth WordPress plugin'], 'packages': [], 'versions': ['before 1.0.4']}
- Fix
- Check the linked advisory for the concrete fix; upgrade to version 1.0.4 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Last activity 29 Oct 2026. Patch Forecast updates every hour.