CVE-2026-14561 in Authora Plugin
Summary
by MITRE • 08/01/2026
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The Authora Easy login with mobile number WordPress plugin versions prior to 1.7.7 contains a critical security vulnerability that fundamentally undermines the authentication mechanism of the affected system. This vulnerability stems from improper handling of one-time login codes within an unauthenticated action, creating a significant backdoor for malicious actors to gain unauthorized access to user accounts including administrative privileges. The flaw represents a severe deviation from established security practices where sensitive authentication data should never be exposed through unauthenticated endpoints.
The technical implementation of this vulnerability manifests in the plugin's response handling where it returns both the one-time login code and a valid verification token through an endpoint that does not require prior authentication. This design flaw allows attackers to make requests to specific API endpoints without providing any credentials, thereby receiving the complete authentication payload necessary for account takeover. The exposed information includes not only the login code but also the verification token that would normally be transmitted through secure channels or stored temporarily in authenticated sessions.
From an operational standpoint, this vulnerability creates a dangerous attack surface that enables attackers to perform unauthorized account takeovers with minimal effort. An attacker who knows a target user's registered mobile number can simply submit a request to the vulnerable endpoint and receive immediate access credentials without needing to bypass any authentication barriers. This capability extends to administrative accounts, potentially allowing full system compromise through a single vulnerability exploitation. The impact is amplified by the fact that this vulnerability affects WordPress installations where users have registered their mobile numbers for authentication purposes.
The security implications of this vulnerability align with CWE-200 (Information Exposure) and CWE-306 (Missing Authentication for Critical Function), as it exposes sensitive authentication data through improper access controls. Additionally, this flaw maps to ATT&CK technique T1110.003 (Credential Stuffing) and T1078.004 (Valid Accounts) where attackers can leverage stolen credentials to maintain persistent access. The vulnerability also demonstrates poor input validation and output sanitization practices that should be addressed through proper security controls and authentication mechanisms.
Mitigation strategies for this vulnerability require immediate action including upgrading to plugin version 1.7.7 or later where the issue has been patched. Organizations should conduct comprehensive security assessments of their WordPress installations to identify other potentially vulnerable plugins, particularly those handling authentication flows or mobile number verification processes. Network monitoring should be enhanced to detect unusual patterns in API endpoint access that might indicate exploitation attempts. Security teams should also consider implementing rate limiting on authentication endpoints and additional verification mechanisms such as two-factor authentication to reduce the impact of potential credential exposure. Regular security audits of third-party plugins and their update cycles are essential for maintaining secure WordPress environments and preventing similar vulnerabilities from being introduced through external components.