---
id: CVE-2026-113616
title: LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
summary: >-
  The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its
  password-reset one-time code to the resolved account's own email address,
  mailing it to the address supplied in the request instead, allowing
  unauthenticated attackers…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-269
product: LogixFast Auth
affected:
  - logixfast_auth < 1.0.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-29T10:49:44.222557Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:06.421Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113616'
references:
  - url: 'https://wpscan.com/vulnerability/ea433cee-716a-4c41-b586-193ed864a1be/'
tags:
  - cve.org
epss: 0.00341
epssPercentile: 0.27835
ingestedAt: '2026-11-01T17:57:46.218Z'
---

## Overview

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

## Affected

- `logixfast_auth < 1.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.