LogixFast Auth

LogixFast Auth has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for LogixFast Auth has a vendor fix available, so running the current release closes it.

All of these findings were reported by Naoki Kawahigashi. LogixFast Auth is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.8.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all LogixFast Auth vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-113616

LogixFast Auth <= 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover

Read the full analysis

Vulnerability Records

1 records
LogixFast Auth banner
Latestv1.0.4

LogixFast Auth

Kazi Sadib Reza

Author

Kazi Sadib Reza

5.0(1)
100/100
Last Updated
2026-10-23 (13d ago)
Active Installs
10+
Downloads
476
Requires WP
6.8+
Requires PHP
8.1+
Tested up to
WP 7.0.8
Created
2026-07-13 (4mo ago)

LogixFast Auth (LogixFastAuth) replaces default WordPress, WooCommerce, Tutor LMS, and Elementor login forms with a fast, mobile-friendly React interface. Features Email, phone, and username login OTP verification (email and SMS) Passkeys (WebAuthn) Gmail SMTP with a Gmail address and app password (admin mail settings) Popup and dedicated login page modes WooCommerce checkout and My Account login replacement Tutor LMS dashboard passkey management Elementor dynamic tags and popup triggers Rate limiting, spam protection, and security controls Admin settings UI with integrations toggles How it works PHP handles WordPress integration, REST API, and security. The frontend UI is built with React and loaded from assets/dist/. External services This plugin contacts external services only when a site administrator enables and configures them: Google (Gmail SMTP) — If you choose Google mail transport and save a Gmail address and app password, the plugin sends email through smtp.gmail.com. The Gmail address, app password, and message content are sent to Google to deliver the email. If an older Google account connection is still saved, the plugin may also refresh an OAuth token with Google. See Google’s Privacy Policy. SMS providers — If you register an SMS provider with the logixfast_auth_sms_providers filter, OTP codes are sent to that provider using API credentials you supply. What data is sent depends on the provider you configure. LogixFastAuth does not send site usage data to the plugin author. Login and registration counters are stored locally in your WordPress database.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C