CVE-2026-77002
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.
Risk Assessment
The vulnerability may allow an unauthenticated attacker to fully take over an administrator account, leading to complete compromise of the WordPress site.
Recommendation
It is recommended to immediately update the plugin to a patched version or remove it if not essential.
Original NVD description (English source)
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.