LogixFast Auth CVE-2026-113616

Exploitation requires only that the target WordPress site runs LogixFast Auth before version 1.0.4 and exposes its password-reset functionality (the default behavior for this authentication plugin). The attacker must know or guess a valid username/account identifier (such as the well-known administrator account) and supplies an attacker-controlled email address in the reset request; the flaw is that the one-time code is mailed to that supplied address instead of the account's registered address. No authentication, no victim interaction, and no non-default configuration are needed (PR:N/UI:N), so the only practical limiting factors are having the vulnerable plugin installed and below 1.0.4 and knowing a target account name. The complete fix is updating to version 1.0.4 as provided by the vendor.

Signals align toward genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and the account-takeover outcome justifies the C:H/I:H/A:H impact and 9.8 base score. SSVC reinforces this: Technical Impact is 'total' and the attack is 'Automatable: yes' - consistent with a password-reset abuse that can be scripted against any known or guessable username, including the administrator. SSVC 'Exploitation: none' indicates no observed in-the-wild activity, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be stated. The vuln.today decision label is act_now, driven by the trivial exploitability and total impact rather than by observed exploitation. The one tension to note: the 'Automatable: yes / total impact / act_now' combination argues for urgency, while 'Exploitation: none' and the absence of a verified working exploit suggest the threat is currently potential rather than demonstrated - treat as urgent-to-patch based on exploitability, not as an in-progress incident.

An unauthenticated attacker submits a password-reset request for the administrator account but supplies their own email address in the request; because the plugin mails the one-time reset code to the attacker-supplied address rather than the account's registered address, the attacker receives the code, completes the reset, and takes over the admin account. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so the exact request format must be confirmed against the advisory. Given AV:N/AC:L/PR:N, no special skill, timing, or victim interaction is required.