{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alogixfastlogixfast_authwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:logixfast:logixfast_auth:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-113616"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LogixFast Auth (\u003c 1.0.4)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["LogixFast"],"content_html":"\u003cp\u003eThe LogixFast Auth WordPress plugin before version 1.0.4 is vulnerable to an authentication bypass flaw. The plugin improperly routes the password reset one-time code to the email address specified in the user-supplied HTTP request rather than the email address linked to the targeted account. This logic error allows unauthenticated attackers to initiate a password reset for any registered user, including administrative accounts, receive the recovery code at an attacker-controlled address, and subsequently perform an account takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to achieve full account takeover of any user on the WordPress site. By targeting administrative accounts, attackers can gain complete site control.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the LogixFast Auth plugin to version 1.0.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user account logs for suspicious password reset events or unauthorized administrative changes if the plugin was publicly accessible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:19:01Z","date_published":"2026-10-29T13:19:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-logixfast-auth-bypass/","summary":"An authentication bypass vulnerability in LogixFast Auth before 1.0.4 allows unauthenticated attackers to reset the password of any user by manipulating the destination email address in password reset requests.","title":"LogixFast Auth: Password Reset Authentication Bypass (CVE-2026-113616)","url":"https://feed.craftedsignal.io/briefs/2026-10-logixfast-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:logixfast:logixfast_auth:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}