LogixFast Auth: Account takeover via password reset
Summary
The LogixFast Auth WordPress plugin before version 1.0.4 sends the password-reset one-time code to an email address supplied in the request instead of the account's own address. An unauthenticated attacker can therefore reset the password of any user, including administrators, and take over the account. The attack requires only network access to a WordPress site with the plugin active.
Affected
- LogixFast Auth WordPress plugin, all versions before 1.0.4 (VulDB lists up to 1.0.3)
- CVSS 9.8 (CVSS 3.1) as provided by the CNA WPScan; VulDB lists 7.3. NVD status: Deferred.
Fixed in
- Version 1.0.4 or later of the LogixFast Auth plugin. The vendor changelog for 1.0.4 was not retrieved; verify the version on the WordPress.org plugin page before rollout.
Workaround
- No vendor workaround documented.
- If an update is not possible immediately, deactivate the plugin; WordPress core password reset then applies.
Exploitation
- No exploitation reported as of 30 Oct 2026. Not listed in CISA KEV.
- No public proof-of-concept or exploit code found in the indexes checked (may be stale).
- EPSS: 0.15 % (percentile 4).
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Update the LogixFast Auth plugin to version 1.0.4 or later on all WordPress sites.
- If an update is not possible, deactivate the plugin.
- Check whether the plugin is installed and active on public sites, especially those with administrator accounts.
- Review administrator accounts for unexpected password changes and review password-reset requests in the logs.
- Enforce strong passwords and two-factor authentication for administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- VulDB entry 428305 vuldb.com
- GitHub tracker issue 3476 github.com
- OffSeq Radar threat entry radar.offseq.com
- threatint CVE record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:10.
Original description (NVD)
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.