EUVD-2026-64227
GHSA-3h2q-j328-63h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running SmilePass plugin
-
DeliverySend login request asserting admin identity
-
ExploitServer skips biometric verification
-
ExecutionReceive valid admin session cookie
-
PersistInstall malicious plugin for RCE
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is that the target WordPress site has the SmilePass Selfie Login plugin (version ≤1.0.2) installed and active, exposing its selfie-login endpoint to the attacker over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions, authentication, or user interaction are required - exploitation works against default configurations of the plugin. What limits exploitation is purely the plugin's install base: sites not running this specific plugin are unaffected, and network reachability of the login endpoint (i.e., an internet-facing or attacker-reachable WordPress instance) is required. |
| Impact | The signals are consistent on severity but mixed on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a trivially reachable, unauthenticated, network-based full compromise, which matches the description of logging in as an administrator. Against that, EPSS is only 0.15% (4th percentile), the vulnerability is not on CISA KEV, and no proof-of-concept is referenced - so there is no confirmed active exploitation, and the bug appears newly disclosed via WPScan/EUVD rather than weaponized. The tension to weigh: authentication-bypass bugs in WordPress plugins are historically easy to reverse-engineer from the fix and are attractive to opportunistic scanners, so the low EPSS likely reflects recency and limited install base rather than difficulty. Any operator running this plugin should treat it as urgent and remove or patch it immediately, because the barrier to full site takeover is essentially zero once an exploit is published. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site running SmilePass Selfie Login, then sends a crafted request to the plugin's selfie-login endpoint asserting the 'admin' account without supplying any valid biometric proof. The server issues a valid authenticated administrator session, and the attacker uses it to install a malicious plugin/theme for remote code execution and full site takeover. No proof-of-concept is publicly referenced, but the attack requires no authentication, no user interaction, and low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 23, 2026
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. Rated CVSS 9.8; no public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), indicating no widespread automated exploitation observed yet.
RemediationAI
No fixed version is identified in the available data - the advisory states the plugin is vulnerable 'through 1.0.2' with no confirmed patched release, so treat this as No vendor-released patch identified at time of analysis. The most reliable remediation is to deactivate and delete the SmilePass Selfie Login plugin entirely and revert affected users to standard WordPress authentication; given the plugin's sole function is the vulnerable login flow, removal eliminates the exposure without loss of other features. If the plugin must remain temporarily, compensating controls include blocking or IP-restricting the plugin's login/authentication endpoint at a WAF or reverse proxy, forcing a full administrator credential and session reset (all sessions may already be forgeable), and enabling audit logging to detect logins that bypass the normal password flow - noting that a WAF rule is only as good as the endpoint pattern it matches and may be bypassable. Monitor the WPScan advisory (https://wpscan.com/vulnerability/51236907-a1b4-4c3b-8c39-adafcab7a2ef/) for a patched version and upgrade to it once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SmilePass Selfie Login is a WordPress authentication plugin that replaces or supplements password login with a biometric 'selfie' flow. The defect is a classic CWE-287 (Improper Authentication): the plugin's login endpoint accepts the identity to be authenticated from the client and issues a WordPress session for that account without cryptographically or server-side validating that the biometric check actually succeeded for that user. Because WordPress plugins run with full application privileges and can call wp_set_auth_cookie() / wp_signon-equivalent logic, a missing verification step upstream directly yields a valid authenticated session for any chosen account. No CPE strings were supplied in the intelligence; affected scope is defined by the plugin version range rather than an operating-system or library CPE.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network login-as-admin with no user interaction (AV:N/AC:L/PR:N/UI:N); administrator access yields full confidentiality, integrity, and availability impact on the site.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.
Executive ViewAI
The SmilePass Selfie Login WordPress plugin (versions through 1.0.2) contains a critical authentication bypass that allows unauthenticated attackers to assume any user account, including administrator access. Organizations using this plugin face immediate risk of full website compromise, data exposure, and business disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable or completely remove the plugin from all affected WordPress installations; implement firewall or network access control rules restricting connections to WordPress login pages; deploy Web Application Firewall rules to block requests targeting the plugin's code paths; enable comprehensive WordPress authentication logging with real-time alerting for multiple failed attempts and anomalous login patterns; establish regular audits of access logs for indicators of compromise; enforce strong password policies and multi-factor authentication for remaining WordPress accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB