The vulnerability affecting the Saad Iqbal All In One Login plugin allows attackers to spoof identities during authentication, resulting in unauthorized access to the WordPress administration area without requiring a valid password. This flaw is a classic example of identity spoofing, classified as CWE-290.

WordPress sites using the Saad Iqbal All In One Login plugin version 2.0.8 or earlier are affected. All releases from the plugin’s initial version up to and including 2.0.8 are impacted.

The CVSS v3.1 score of 5.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves remote submission of forged authentication requests to the plugin’s login endpoint, which could grant administrative access, though the advisory does not provide specific exploitation details.