The Login with Salesforce plugin for WordPress up to version 1.0.2 fails to validate that a user is permitted to authenticate via Salesforce. This omission allows an unauthenticated attacker to assume the identity of any site user, including administrators, by simply supplying a valid email address. The vulnerability directly undermines account confidentiality and can be leveraged for full site compromise.

WordPress sites that have installed the Login with Salesforce plugin version 1.0.2 or earlier are affected. The plugin, identified only as Login with Salesforce, is widely used to provide single sign‑on via Salesforce. No alternate product versions are listed, so any installation of the plugin at or below 1.0.2 must be considered vulnerable.

The issue carries a CVSS score of 9.1, denoting critical impact. The EPSS score is below 1 %, indicating a low probability of exploitation, yet the lack of authentication checks makes the attack surface very simple. Based on the description, it is inferred that the likely attack vector is a remote request to the plugin’s authentication endpoint, where an attacker supplies a legitimate email address. The vulnerability is not currently in the CISA KEV catalog, but the potential for immediate privilege escalation warrants prompt remediation.