Threats tagged 'ghsa-xjfv-965p-5j67'

The LogixFast Auth WordPress plugin versions before 1.0.4 contain a vulnerability where the password-reset one-time code is sent to the email address provided in the reset request rather than the legitimate user's registered email. This flaw enables unauthenticated attackers to reset any user's password, including administrators, potentially leading to account takeover.