CVE-2026-113616

critical · 9.8

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

9.8

CVSS

0.3%

EPSS (exploit prob.)

28th

EPSS percentile

2026-10-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

References

https://wpscan.com/vulnerability/ea433cee-716a-4c41-b586-193ed864a1be/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-113616