CVE-2026-77002: SmilePass Selfie Login Auth Bypass Vulnerability

CVE-2026-77002 Overview

CVE-2026-77002 is an authentication bypass vulnerability in the SmilePass Selfie Login WordPress plugin through version 1.0.2. The plugin fails to perform server-side verification of the identity it is asked to authenticate. Unauthenticated attackers can log in as any registered account, including administrators, by supplying a target username or user identifier. The flaw is classified under [CWE-287] Improper Authentication and affects all installations of the plugin up to and including 1.0.2.

Critical Impact
Unauthenticated network attackers can gain full administrative access to affected WordPress sites, enabling site takeover, content manipulation, and malware deployment.

Affected Products

SmilePass Selfie Login WordPress plugin versions through 1.0.2
WordPress sites with the plugin installed and active
Any hosting environment exposing the plugin's login endpoint to the internet

Discovery Timeline

2026-08-22 - CVE-2026-77002 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77002

Vulnerability Analysis

The SmilePass Selfie Login plugin implements biometric selfie-based authentication for WordPress. The plugin trusts client-supplied identity assertions and issues a WordPress authentication session without independently validating the claim against a server-side biometric match. An attacker who submits a request to the plugin's login handler with a chosen account identifier receives a valid session for that account.

Because the check occurs only on the client, no cryptographic proof or verified biometric template is required. This turns a claimed identity into an authenticated session and grants the attacker the target account's privileges.

Root Cause

The root cause is missing server-side authentication verification, mapped to [CWE-287] Improper Authentication. The plugin's login handler accepts identity input from the request and calls WordPress session-issuance functions without validating a corresponding biometric proof, signature, or challenge response. Trust is placed entirely on the client, which the attacker controls.

Attack Vector

The attack requires no authentication, no user interaction, and no elevated privileges. An attacker enumerates or guesses a target username, such as admin, and issues a crafted HTTP request to the plugin's authentication endpoint. The server responds with valid WordPress authentication cookies for that account. The attacker then accesses /wp-admin/ with full privileges of the impersonated user. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-77002

Indicators of Compromise

Successful WordPress login events for administrative accounts without corresponding multi-factor or password-based authentication steps in access logs.
Requests to SmilePass plugin endpoints under /wp-content/plugins/smilepass-selfie-login/ from unrecognized IP addresses.
New administrator accounts, plugin installs, or theme file modifications following unusual login activity.
Session cookies issued to IP addresses that do not match the user's normal geographic pattern.

Detection Strategies

Audit WordPress wp_users and wp_usermeta tables for unexpected new accounts or role changes.
Enable WordPress authentication logging via a security plugin and correlate login events with source IP reputation.
Inspect web server access logs for POST requests targeting SmilePass authentication endpoints without prior GET requests to the login form.

Monitoring Recommendations

Monitor for administrator logins outside business hours or from anomalous geolocations.
Alert on file writes to wp-content/plugins/, wp-content/themes/, and wp-content/uploads/ from PHP processes following a login event.
Track outbound connections from the web server to unfamiliar hosts, which may indicate post-exploitation command and control.

How to Mitigate CVE-2026-77002

Immediate Actions Required

Deactivate and remove the SmilePass Selfie Login plugin from all WordPress installations until a fixed version is released.
Force a password reset for all WordPress accounts, particularly administrators, and rotate any API keys stored in the site.
Invalidate all active WordPress sessions by updating the SECURE_AUTH_KEY and related salts in wp-config.php.
Review installed plugins, themes, and administrative users for unauthorized additions or modifications.

Patch Information

No patched version is referenced in the vulnerability disclosure at the time of publication. The plugin is vulnerable through version 1.0.2. Refer to the WPScan Vulnerability Report for updated remediation guidance and monitor the plugin's WordPress.org listing for a security release.

Workarounds

Remove the plugin directory entirely from wp-content/plugins/ if deactivation through the admin interface is not possible.
Restrict access to /wp-admin/ and /wp-login.php using web server IP allowlisting or HTTP basic authentication.
Deploy a web application firewall rule to block requests to SmilePass plugin endpoints until the plugin is removed or patched.
Enable multi-factor authentication on all administrator accounts through a separate, trusted plugin.

bash

# Remove the vulnerable plugin from the WordPress installation
cd /var/www/html/wp-content/plugins/
rm -rf smilepass-selfie-login/

# Rotate WordPress authentication salts to invalidate active sessions
curl -s https://api.wordpress.org/secret-key/1.1/salt/ >> /tmp/new-salts.txt
# Then manually replace the AUTH_KEY block in wp-config.php with the new values