Authora
Monthly
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.