CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.16% chance of exploitation in the next 30 days, 6th percentile

Published

2026-08-01

Updated

2026-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4025601f-ed33-4772-b716-a9979830e10d/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1456
• CVE-2026-14567
• CVE-2026-14558
• CVE-2026-14568
• CVE-2026-14557
• CVE-2026-1457