CVE-2026-77002: SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

Q: Who can exploit this issue?

Any unauthenticated user can exploit it. No existing WordPress account or prior authentication is required.

Q: Which accounts are at risk?

Any registered account can be targeted, including WordPress administrator accounts. An attacker could therefore obtain administrative access if an administrator account exists.

Q: Are affected sites protected by client-side identity checks?

No. The plugin does not perform server-side verification of the identity submitted for authentication, so client-side checks do not prevent impersonation.

Q: Which plugin versions are affected?

SmilePass Selfie Login versions through 1.0.2 are affected.

Published Aug 22, 2026

Updated

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

Affected Software

1 affected component

SmilePass SmilePass Selfie Login (WordPress plugin)<=1.0.2

Event History

Aug 22, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can exploit it. No existing WordPress account or prior authentication is required.

Which accounts are at risk?

Any registered account can be targeted, including WordPress administrator accounts. An attacker could therefore obtain administrative access if an administrator account exists.

Are affected sites protected by client-side identity checks?

No. The plugin does not perform server-side verification of the identity submitted for authentication, so client-side checks do not prevent impersonation.

Which plugin versions are affected?