EUVD-2026-64227
GHSA-3h2q-j328-63h4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network login-as-admin with no user interaction (AV:N/AC:L/PR:N/UI:N); administrator access yields full confidentiality, integrity, and availability impact on the site.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.
AnalysisAI
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is that the target WordPress site has the SmilePass Selfie Login plugin (version ≤1.0.2) installed and active, exposing its selfie-login endpoint to the attacker over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent on severity but mixed on urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a WordPress site running SmilePass Selfie Login, then sends a crafted request to the plugin's selfie-login endpoint asserting the 'admin' account without supplying any valid biometric proof. The server issues a valid authenticated administrator session, and the attacker uses it to install a malicious plugin/theme for remote code execution and full site takeover. … |
| Remediation | No fixed version is identified in the available data - the advisory states the plugin is vulnerable 'through 1.0.2' with no confirmed patched release, so treat this as No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations running SmilePass Selfie Login and immediately disable or remove the plugin; preserve access logs for forensic review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today