critical advisory October 29, 2026

LogixFast Auth: Password Reset Authentication Bypass (CVE-2026-113616)

An authentication bypass vulnerability in LogixFast Auth before 1.0.4 allows unauthenticated attackers to reset the password of any user by manipulating the destination email address in password reset requests.

Triage facts

Revision 1

Applicability: LogixFast Auth (< 1.0.4)
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Oct 29, 13:19 UTC
Vulnerabilities: 1 CVE
Source quality: A1Very likely

The LogixFast Auth WordPress plugin before version 1.0.4 is vulnerable to an authentication bypass flaw. The plugin improperly routes the password reset one-time code to the email address specified in the user-supplied HTTP request rather than the email address linked to the targeted account. This logic error allows unauthenticated attackers to initiate a password reset for any registered user, including administrative accounts, receive the recovery code at an attacker-controlled address, and subsequently perform an account takeover.

Impact

Successful exploitation allows unauthenticated attackers to achieve full account takeover of any user on the WordPress site. By targeting administrative accounts, attackers can gain complete site control.

Recommendation

Upgrade the LogixFast Auth plugin to version 1.0.4 or later immediately.
Audit WordPress user account logs for suspicious password reset events or unauthorized administrative changes if the plugin was publicly accessible.

Immediate actions

Upgrade LogixFast Auth to 1.0.4 or later

IT Operations 24h

Threat Hunt

Search WordPress access logs for multiple password reset requests to the same target username originating from different source IPs or followed by suspicious administrative logins

T1588.006 high high confidence hunt now

Data: Web server access logs, WordPress authentication/login logs

Mitigations