The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
CVE-2026-2418
NONE
EPSS 0.10%
Updated Mar 05, 2026
WordPress
CVE Details
CVE ID
CVE-2026-2418
Published Date
Mar 05, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.10%
Likelihood of exploitation in next 30 days
Percentile:
28.1th percentile (higher than 28.1% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory