Cpe:2.3:a:logixfast:logixfast_auth:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alogixfastlogixfast_authwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:19:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLogixFast Auth: Password Reset Authentication Bypass (CVE-2026-113616)https://feed.craftedsignal.io/briefs/2026-10-logixfast-auth-bypass/Thu, 29 Oct 2026 13:19:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-logixfast-auth-bypass/An authentication bypass vulnerability in LogixFast Auth before 1.0.4 allows unauthenticated attackers to reset the password of any user by manipulating the destination email address in password reset requests.The LogixFast Auth WordPress plugin before version 1.0.4 is vulnerable to an authentication bypass flaw. The plugin improperly routes the password reset one-time code to the email address specified in the user-supplied HTTP request rather than the email address linked to the targeted account. This logic error allows unauthenticated attackers to initiate a password reset for any registered user, including administrative accounts, receive the recovery code at an attacker-controlled address, and subsequently perform an account takeover.

Impact

Successful exploitation allows unauthenticated attackers to achieve full account takeover of any user on the WordPress site. By targeting administrative accounts, attackers can gain complete site control.

Recommendation

  • Upgrade the LogixFast Auth plugin to version 1.0.4 or later immediately.
  • Audit WordPress user account logs for suspicious password reset events or unauthorized administrative changes if the plugin was publicly accessible.
]]>criticaladvisory