未評価

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time...

CVE-2026-113616 SecPulse初出 15:00

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
CVE	LogixFast Auth	1.0.4 未満	1.0.4

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web contact@wpscan.com
web nvd.nist.gov
web wpscan.com
web github.com