CVE-2026-77002

CVE-2026-77002 is a complete authentication bypass in the SmilePass WordPress plugin—a 'selfie login' extension that performs zero server-side verification. The server accepts whatever identity claim the client transmits, bypassing any biometric matching entirely. Installing this plugin doesn't just fail to secure authentication; it actively undermines it by creating a false sense of protection while leaving the door open. This is a structural inversion where the security mechanism becomes the attack vector. The CVSS 9.8 score reflects severity given exploitation, but the EPSS score of 0.00146 suggests low observed exploitation probability. This gap requires interpretation: the attack requires no specialized tooling and targets WordPress admin access, which routinely leads to PHP code execution through theme editors or plugin uploads. The low EPSS likely reflects limited attacker attention rather than inherent difficulty. Monitor for opportunistic scanning activity post-disclosure. The plugin shows no signs of active maintenance—the 'through 1.0.2' language indicates the vulnerability is effectively frozen. No patch is coming from the author. This creates a compounding problem: abandoned security code persists indefinitely in production, generating false confidence while the underlying flaw ages unpatched. The WordPress plugin ecosystem lacks meaningful deprecation mechanisms, so these installations persist long after disclosure threads fade. What makes this worse than a typical auth bypass: the vulnerability leaves zero forensic trail. You cannot audit whether exploitation occurred because unauthenticated admin logins generate no anomalous entries. The exposure window includes both ongoing vulnerability and historical uncertainty. Prioritize: locate all SmilePass installations immediately and remove them. There is no hardened configuration—only removal eliminates the risk. Audit for similar 'security' plugins that claim verification but operate entirely client-side. The WordPress ecosystem ships self-certified security products with no audit trail, so treat any authentication-related plugin as requiring explicit verification of its server-side validation architecture before deployment.

Reviewed through automated stages and approved by a human before publication.