Vulnerability · Published Aug 1, 2026 · Assigned by WPScan

CVE-2026-14561Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

Medium 6.5

In plain English

A medium-severity improper authentication in Authora : Easy login with mobile number from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Authora : Easy login with mobile number	0 – before 1.7.7

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/4025601f-ed33-4772-b716-a9979830e10d/ exploit, vdb-entry, technical-description