EUVD-2026-51708
GHSA-qh94-hqp6-76h4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
PR:N confirmed by unauthenticated endpoint; C:H/I:H reflects admin account takeover capability, correcting the original underscored C:L/I:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.
AnalysisAI
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Technical ContextAI
The Authora plugin provides an alternative WordPress authentication flow using one-time codes (OTCs) delivered to registered mobile numbers. The vulnerability is rooted in CWE-287 (Improper Authentication): the plugin's unauthenticated AJAX or REST action that handles OTC validation returns both the plaintext OTC and a valid verification token in the server's HTTP response body, rather than consuming the token server-side and issuing a session only after out-of-band SMS confirmation. This design flaw means the secret never leaves the server-side response - it is handed directly to whoever calls the endpoint. CPE cpe:2.3:a:unknown:authora_:_easy_login_with_mobile_number:*:*:*:*:*:*:* identifies the affected software family across all versions prior to 1.7.7. The secondary impact - the ability to create arbitrary accounts - suggests the same endpoint or a companion unauthenticated action also allows account registration without proper identity verification.
RemediationAI
Upgrade the Authora : Easy login with mobile number WordPress plugin to version 1.7.7 or later - this is the vendor-released patch confirmed by EUVD-2026-51708 and the WPScan advisory at https://wpscan.com/vulnerability/4025601f-ed33-4772-b716-a9979830e10d/. If immediate patching is not feasible, the most effective compensating control is to deactivate the Authora plugin entirely via the WordPress plugin dashboard, which disables the vulnerable endpoint at the cost of removing mobile-based login for all users. As a more surgical alternative, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php for the specific Authora action names handling OTC validation can reduce exposure while preserving functionality for authenticated flows, though identifying the exact action parameter requires inspecting plugin source code. Do not rely on obscurity of mobile numbers as a control - phone numbers are often discoverable via social media or organizational directories.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today