CVE-2026-14561: Authora WordPress Auth Bypass Vulnerability

CVE-2026-14561 Overview

CVE-2026-14561 affects the Authora: Easy login with mobile number WordPress plugin in versions before 1.7.7. The plugin fails to keep its one-time login code confidential. It returns both the one-time code and a valid verification token in the response of an unauthenticated action. Attackers who know a registered mobile number can authenticate as that user, including administrators. The flaw also permits creation of arbitrary accounts without authorization. This authentication bypass is categorized under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated attackers can log in as any registered user, including WordPress administrators, by exploiting an exposed one-time code and verification token.

Affected Products

Authora: Easy login with mobile number WordPress plugin versions before 1.7.7
WordPress sites using mobile-number authentication provided by this plugin
Any WordPress installation exposing the plugin's unauthenticated login endpoint

Discovery Timeline

2026-08-01 - CVE-2026-14561 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-14561

Vulnerability Analysis

The Authora plugin implements a passwordless login flow keyed to a user's registered mobile number. A user requests a one-time code, receives it via SMS, and submits it to obtain a session. The plugin exposes this workflow through an unauthenticated action so anonymous visitors can initiate login.

The implementation returns the one-time code and a valid verification token directly in the HTTP response body of that unauthenticated action. An attacker who submits a login request for a target mobile number receives the secret material required to complete authentication. No SMS interception, brute force, or user interaction is required.

The same weakness enables arbitrary account creation. An attacker can drive the registration flow with a chosen mobile number and consume the returned code and token to establish a valid session against a new account.

Root Cause

The root cause is disclosure of authentication secrets through an unauthenticated response channel. The one-time code must remain confidential to the recipient of the SMS. Returning it in the HTTP response collapses the second factor into a single-request bypass and defeats the purpose of the code entirely.

Attack Vector

Exploitation is remote and network-based over HTTP or HTTPS. The attacker needs the registered mobile number of a target account, which is often guessable, harvestable from public sources, or predictable for administrator accounts. The attacker sends a crafted request to the plugin's unauthenticated login action, parses the code and token from the response, and submits them to complete authentication as the target user.

See the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-14561

Indicators of Compromise

Unexpected administrator or user logins that were not preceded by a matching outbound SMS delivery in provider logs.
New user accounts registered through the mobile-login flow that do not correspond to legitimate onboarding activity.
Sequential or scripted requests to the plugin's unauthenticated login endpoint targeting multiple mobile numbers from a single source.

Detection Strategies

Inspect web server access logs for repeated POST requests to the Authora plugin's AJAX or REST endpoints originating from a small set of IP addresses.
Correlate WordPress wp_login events with the plugin's code-issuance events and flag logins without a corresponding SMS delivery record.
Alert on privileged account authentications that originate from IP addresses or user agents not previously associated with those accounts.

Monitoring Recommendations

Enable verbose logging for authentication events and retain SMS provider delivery logs for correlation.
Monitor for spikes in new user registrations tied to the plugin's registration endpoint.
Track administrator session creation events and generate alerts for any authentication that bypasses expected multi-factor challenges.

How to Mitigate CVE-2026-14561

Immediate Actions Required

Update the Authora: Easy login with mobile number plugin to version 1.7.7 or later on every affected WordPress site.
Rotate credentials and force logout of all sessions for administrator accounts after patching to invalidate any attacker-established sessions.
Audit the WordPress user table for unfamiliar accounts created since the plugin was installed and remove any that are illegitimate.

Patch Information

The vendor addressed the disclosure by removing the sensitive fields from the unauthenticated response in version 1.7.7. Site operators should upgrade through the WordPress plugin repository or via WP-CLI. Verify the installed version using wp plugin get authora --field=version after upgrade.

Workarounds

Deactivate the Authora plugin until the site can be upgraded to version 1.7.7 or later.
Restrict access to the plugin's login and registration endpoints at the web application firewall or reverse proxy layer while patching is in progress.
Temporarily disable mobile-number login and require standard WordPress authentication with strong passwords and multi-factor authentication.

bash

# Configuration example
wp plugin update authora --version=1.7.7
wp plugin get authora --field=version
wp user session destroy --all