Authentication Bypass in SmilePass Selfie Login Plugin for WordPress
CVE-2026-77002

Currently unrated

Key Information:

Vendor

WordPress
Status
Smilepass Selfie Login
Vendor
CVE Published:
22 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77002?

The SmilePass Selfie Login plugin for WordPress, up to version 1.0.2, is susceptible to an authentication bypass vulnerability. This flaw allows attackers to impersonate any registered user, including administrators, by circumventing the necessary server-side identity verification. Consequently, this lack of authentication can lead to unauthorized access to sensitive accounts and data, posing significant security risks for users and site administrators.

Affected Version(s)

SmilePass Selfie Login 0 <= 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77002 - Proof of Concept

References

https://wpscan.com/vulnerability/51236907-a1b4-4c3b-8c39-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Alenazi (Nxploited)
WPScan
.