WordPress LogixFast Auth Plugin Email Verification Bypass

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-113616 represents a critical authentication bypass in the LogixFast Auth WordPress plugin versions before 1.0.4. The vulnerability stems from a flawed password-reset mechanism that sends one-time codes to attacker-supplied email addresses rather than the account owner's registered email. This allows unauthenticated attackers to initiate password resets for any user—including administrators—and intercept the verification code, enabling complete account takeover. With a CVSS score of 9.8 (critical), this vulnerability poses an extreme risk to WordPress sites relying on this plugin, as it requires no authentication and provides direct administrative access to threat actors.

Casky.ai's 224 mapped skills detect this attack pattern by analyzing behaviors aligned with MITRE ATT&CK technique TA0004 (Privilege Escalation). Claude AI's extended reasoning identifies the core vulnerability signature: suspicious password-reset requests where the email recipient differs from the account owner's stored email address. Practitioners using Casky would observe findings highlighting anomalous authentication flows—specifically, detection of account compromise attempts via unauthorized password reset flows, email parameter manipulation, and privilege elevation through compromised administrative accounts. The platform correlates these behavioral indicators across the attack chain, enabling security teams to identify exploitation attempts before attackers gain persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-113616.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-113616

Casky has 224 skills that investigate the attack patterns behind CVE-2026-113616. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn