Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-2418 Unauthenticated User Impersonation Vulnerability in Login with Salesforce WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2418
Post summary
The content announces CVE-2026-2418, describing it as an unauthenticated user impersonation flaw in the Salesforce WordPress plugin, but provides no PoC, exploit, patch, or evidence of active attacks.
CVE-2026-2418 The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be auth… https://www.cve.org/CVERecord?id=CVE-2026-2418
Post summary
The note reports a flaw in the Login with Salesforce WordPress plugin that permits unauthenticated users to log in via Salesforce. No PoC, exploit, patch, or active exploitation details are provided.