Logixfast Auth
Monthly
Unauthenticated password reset in the LogixFast Auth WordPress plugin before 1.0.4 allows remote attackers to take over any account, including an administrator account, by supplying an attacker-controlled email address during the reset flow. The plugin sends the one-time reset code to the supplied address rather than the resolved account's registered email, so knowing or guessing a valid username is the main prerequisite. A public PoC reference exists; it is not verified as working exploit code, and active exploitation is not confirmed in the supplied KEV data, but the CVSS 9.8 and act_now priority warrant urgent patching to 1.0.4.
Unauthenticated password reset in the LogixFast Auth WordPress plugin before 1.0.4 allows remote attackers to take over any account, including an administrator account, by supplying an attacker-controlled email address during the reset flow. The plugin sends the one-time reset code to the supplied address rather than the resolved account's registered email, so knowing or guessing a valid username is the main prerequisite. A public PoC reference exists; it is not verified as working exploit code, and active exploitation is not confirmed in the supplied KEV data, but the CVSS 9.8 and act_now priority warrant urgent patching to 1.0.4.