CVE-2026-14561
Received Received - Intake

Unauthenticated Login Bypass in Authora WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-14561
EUVD
EUVD-2026-51708

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
authora easy_login_with_mobile_number to 1.7.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Authora Easy login with mobile number WordPress plugin before version 1.7.7 has a vulnerability where it exposes one-time login codes and verification tokens in unauthenticated API responses. This allows attackers to log in as any user if they know the user's mobile number, including administrators, or create arbitrary accounts without authentication.

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'Authora : Easy login with mobile number' is installed and if its version is below 1.7.7. Inspect network traffic for unauthenticated responses containing login codes or verification tokens. Test by attempting to log in with a known mobile number and observe if the response reveals sensitive data.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain unauthorized access to user accounts, including administrative accounts, by exploiting exposed login codes and tokens. Attackers could steal sensitive data, modify content, or take full control of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, reputational damage, and loss of compliance certifications due to data breaches resulting from this issue.

Mitigation Strategies

Update the Authora Easy login with mobile number WordPress plugin to version 1.7.7 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart