CVE-2026-77002 in Selfie Login Plugin
Summary
by MITRE • 08/22/2026
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified within the SmilePass Selfie Login WordPress plugin versions up to and including 1.0.2 represents a critical authentication bypass flaw rooted in fundamental design failures regarding server-side validation protocols. The core technical issue lies in the application's reliance on client-side or external biometric verification mechanisms without implementing corresponding integrity checks on the backend system responsible for session management and user identity assertion. When an unauthenticated actor initiates a login sequence, the plugin accepts the authentication request based solely on the presence of a valid token or signal from the selfie recognition service, failing to verify that this signal is legitimately associated with the specific account being accessed in real-time through secure cryptographic binding. This architectural oversight effectively decouples the biometric verification step from the actual credential validation process, allowing an attacker to manipulate the authentication flow by supplying arbitrary identifiers for registered user accounts while presenting a valid selfie match, thereby tricking the system into granting access without requiring knowledge of passwords or other traditional secrets.
From a technical perspective, this flaw aligns with CWE-287, which describes Improper Authentication, specifically manifesting as an identity assertion failure where the system fails to properly verify that the entity claiming an identity is indeed that entity. The absence of server-side verification means that the application trusts external inputs or intermediate states without validating their origin and integrity against a trusted source of truth within its own database or session store. This lack of rigorous validation allows for unauthenticated access, categorized under CWE-306, as the system permits actions requiring prior authentication to be performed by users who have not been authenticated at all. The vulnerability exploits the trust placed in the biometric service's output without ensuring that this output is cryptographically signed or linked securely to the specific login request context, leaving the application vulnerable to replay attacks and identity spoofing where an attacker can impersonate any user whose account exists within the WordPress database.
The operational impact of this vulnerability is severe due to its potential for complete system compromise across all privilege levels. Since the flaw allows logging in as any registered account, including those with administrator privileges, attackers can gain full control over the WordPress installation. This level of access enables the execution of arbitrary code, modification of site content and settings, theft of sensitive user data stored within the database, and further lateral movement if other services are integrated or accessible from the compromised server environment. The ease of exploitation means that automated scanning tools could rapidly identify vulnerable instances across the internet, leading to widespread unauthorized access incidents. Furthermore, because the vulnerability affects authentication logic at a foundational level, it undermines the integrity of all security controls dependent on accurate user identification, potentially exposing sensitive information and allowing attackers to establish persistent backdoors within the application infrastructure.
Mitigation strategies must prioritize immediate remediation through software updates or architectural changes if an update is not yet available by the vendor. Administrators should upgrade to a patched version of the SmilePass Selfie Login plugin that implements robust server-side verification, ensuring that biometric authentication tokens are cryptographically bound to specific user identities and login sessions using secure hashing mechanisms such as HMACs signed with secret keys known only to the application backend. In cases where immediate patching is not feasible, temporary mitigations include disabling the selfie login feature entirely in favor of traditional password-based or multi-factor authentication methods that do not suffer from this verification gap. Additionally, implementing strict input validation and ensuring that all authentication flows undergo rigorous server-side checks against a trusted identity provider can prevent similar vulnerabilities. Regular security audits focusing on authentication logic and adherence to industry standards like OWASP Authentication Cheat Sheet guidelines are essential to detect and rectify such critical flaws before they can be exploited in production environments.