LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
The LogixFast Auth WordPress plugin is affected, allowing unauthenticated attackers to take over any user account, including administrator accounts. The password-reset code is sent to an attacker-supplied email address instead of the account owner's, so the attacker can set a new password and gain full control of the account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Affected versions
- Unknown LogixFast Auth
fixed in 1.0.4