Description

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-22T06:16:17.510Z",
  "pubdate": "2026-08-22T06:16:17.510Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in the SmilePass Selfie Login WordPress plugin through version 1.0.2. The security flaw stems from an absolute absence of server-side validation regarding the user identity presented during the login sequence.\nThe vulnerability allows remote, unauthenticated threat actors to forge authentication requests and forcefully log into arbitrary registered accounts on the target WordPress installation. Because the application blindly trusts client-supplied identity claims without cryptographic proof or backend verification, attackers can target privileged roles, including administrative accounts.\nSuccessful exploitation of this issue yields complete administrative takeover of the underlying WordPress environment, granting the attacker unrestricted control over the web application, database, and potentially the underlying server infrastructure.\nThe risk implication is critical, as no special privileges or prior authentication are required to execute the attack. Remediation requires updating the affected software or disabling the plugin until a secure patch implementing robust server-side identity verification is deployed.",
  "technicalDetails": "The vulnerability resides within the authentication handling mechanism of the SmilePass Selfie Login WordPress plugin through version 1.0.2. The root cause of the flaw is a complete lack of server-side validation and verification logic for the asserted user identity during the authentication process.\nIn a secure authentication workflow, the backend server must cryptographically verify or independently cross-reference the identity claims submitted by the client against trusted session states or authentication tokens. However, the vulnerable component in this plugin accepts the client-supplied user identifier without performing any integrity checks or backend validation routines to confirm that the requesting entity matches the claimed account.\nTo exploit this vulnerability, an unauthenticated attacker interacts with the plugin's login endpoints via network exposure. By intercepting or crafting HTTP requests intended for the authentication handler, the attacker can manipulate the user parameter or identification tokens to reflect a target username, such as an administrator account. Due to the lack of server-side enforcement, the application processes the falsified input as a legitimate login attempt, successfully instantiating an authenticated session for the specified user.\nThe attack flow proceeds as follows: First, the attacker enumerates or determines a valid target username on the WordPress site. Second, the attacker formulates an authentication request directed at the plugin's vulnerable endpoint, injecting the target user's identifier. Third, the plugin processes the request without validating the user's cryptographic identity or selfie verification data on the backend. Fourth, the application issues a valid session cookie or authentication token associated with the target account. Finally, the attacker utilizes the acquired session state to access the administrative dashboard, enabling post-exploitation activities such as executing arbitrary code, installing malicious plugins, or modifying site configurations."
}