The SmilePass Selfie Login WordPress plugin, in versions up to 1.0.2, does not perform any server‑side identity verification during the authentication process. This flaw allows an attacker to submit any user identifier and gain access as that user without providing a valid credential, effectively bypassing authentication and potentially granting full administrative privileges.

The vulnerability affects the SmilePass Selfie Login plugin for WordPress, version 1.0.2 and earlier. Site administrators using this plugin have no vendor‑provided name listed, so the product is commonly described simply as "SmilePass Selfie Login".

No CVSS score is provided, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Nevertheless, authenticated bypass of an administrative interface is a high‑impact risk, as it enables an unauthenticated user to log in as any registered account, including administrators. Attackers can exploit this by simply sending a request to the plugin’s authentication endpoint with the desired username, bypassing all server‑side checks.