CVE-2026-113616
Critical · 9.8CVSS
9.8
EPSS
0.3%
Published
Oct 29, 2026
CISA due date
—
The record
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-269
- CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-269
- CVE-2026-61850 Kargo manages and automates the promotion of software artifacts. CWE-269
- CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for… CWE-269
- CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine… CWE-269
- CVE-2026-101213 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege… CWE-269
- CVE-2026-59386 A SpaceSupporter could improperly modify an application's start command and… CWE-269
- CVE-2026-86393 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-269