PT-2026-23220 · Salesforce+1 · Salesforce+1

Khaled Alenazi · Published 2026-03-05 · Updated 2026-03-06 · CVE-2026-2418

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Login with Salesforce WordPress plugin version 1.0.2

Description The Login with Salesforce WordPress plugin does not properly validate user access permissions when logging in through Salesforce. This allows unauthenticated users to authenticate as any user, including administrators, simply by knowing their email address.

Recommendations Update the Login with Salesforce WordPress plugin to a version beyond 1.0.2.

Exploit

Fix

Related Identifiers

CVE-2026-2418

Affected Products

Login With Salesforce

Salesforce

References · 5

• 🔥 https://wpscan.com/vulnerability/b25c6cbc-39e7-4fa0-af0b-ee7759d2c497 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2418 · Security Note
• https://t.me/cveNotify/154487 · Telegram Post
• https://twitter.com/CVEnew/status/2029454824870486462 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029564181913997424 · Twitter Post