WordPress Plugin Vulnerabilities
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
Description
The plugin does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Proof of Concept
Affects Plugins
Fixed in 1.0.4 References
CVE
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-27 (about 2 days ago)
Added
2026-10-27 (about 1 day ago)
Last Updated
2026-10-28 (about 8 hours ago)
