WordPress Plugin Missing Server-Side Authentication Verification

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SmilePass Selfie Login WordPress plugin through version 1.0.2 contains a critical authentication bypass vulnerability (CWE-287) that allows any unauthenticated attacker to gain unauthorized access to any registered user account, including administrator accounts. The plugin fails to implement server-side verification of user identity during the authentication process, meaning an attacker can simply claim to be any user without providing valid credentials. This affects all WordPress installations using this plugin, putting admin accounts and sensitive site data at immediate risk. With a CVSS score of 9.8, this represents one of the most severe vulnerability categories—complete authentication failure that requires no user interaction and can be exploited remotely with minimal complexity.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability by correlating MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access) with Claude's extended reasoning capabilities. Security practitioners using Casky would observe multiple detection indicators: anomalous authentication requests missing cryptographic validation (Credential Access patterns), privilege elevation without credential submission, and behavioral anomalies showing unauthorized admin-level activity from new or suspicious sessions. The platform's skill mapping would highlight authentication mechanism bypass attempts, unauthorized account takeover, and lateral movement patterns originating from initially compromised admin accounts—allowing teams to identify exploitation attempts in real-time and correlate them to this specific vulnerability pattern before attackers establish persistence or exfiltrate data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77002.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77002

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77002. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn