WordPress LogixFast Auth plugin < 1.0.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin LogixFast Auth versions 1.0.4...

CVE-2026-113616

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's,...

CVE-2026-113616 LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's,...

CVE-2026-113616

The LogixFast Auth WordPress plugin (versions before 1.0.4 ) is vulnerable to an unauthenticated account takeover due to a flaw in the password reset mechanism. The plugin fails to send the one-time password reset code to the registered email address of the account. Instead, it delivers the code ...

EUVD-2026-112626

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's,...