The LogixFast Auth WordPress plugin before version 1.0.4 fails to send the password‑reset one‑time code to the account’s registered email address. Instead, it transmits the code to the email address supplied in the reset request, allowing unauthenticated attackers to reset any user’s password, including administrators. This flaw enables account takeover and reflects a weakness in how password reset tokens are handled.

This vulnerability affects installations of the LogixFast Auth plugin on WordPress sites running any version earlier than 1.0.4. Sites that have the plugin available to public users and have not applied the 1.0.4 or later update are at risk.

The issue can be exploited without authentication, rendering the vulnerability potentially critical for systems with unrestricted access to password reset functionality. While EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, the risk remains high due to the possibility of taking over administrator accounts. Successful exploitation requires only knowledge of the target user’s email address and standard HTTP requests to trigger a password reset.