A critical authentication bypass vulnerability in the SmilePass Selfie Login plugin allows unauthenticated attackers to gain full administrative access to affected WordPress sites.

This flaw stems from improper authentication (CWE-287), where the plugin fails to validate the identity of users during the login process. An unauthenticated attacker can forge authentication requests to impersonate any registered user.

The impact of this vulnerability is total, as it allows for complete account takeover, including administrative accounts. Given the CVSS score of 9.8, this represents a critical risk that could lead to full site compromise, unauthorized data exfiltration, and the installation of malicious backdoors. Organizations relying on this plugin face significant reputational and operational damage if their administrative controls are bypassed.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately deactivate and uninstall the SmilePass Selfie Login plugin until a secure update is confirmed by the vendor.

Proactive Monitoring: Review web server and WordPress authentication logs for irregular login patterns, such as multiple successful logins for administrative accounts from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized authentication attempts and monitor for suspicious requests directed at the plugin endpoint.

Public Exploit Available: Unknown.

This vulnerability presents an extreme risk to the integrity and confidentiality of any WordPress environment using the affected plugin. Because the flaw allows for unauthenticated administrative access, immediate removal of the plugin is the only effective way to eliminate the attack surface until the vendor releases a verified, secure version.