Authora returns the one-time code needed to log in as any known mobile user
Authora before 1.7.7 returns both a one-time login code and a valid verification token in the response to an unauthenticated action. A visitor who knows a user's registered mobile number can request those values and complete login as that user, including an Administrator, or use the same flow to create arbitrary accounts. The published record does not disclose the action, mobile-number and token parameters, response fields or verification function.
- Component
- Authora : Easy login with mobile number
- Plugin slug
authora-easy-login-with-mobile-number- Affected
- < 1.7.7
- Safe version
1.7.7- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Authora to 1.7.7 or later. Review mobile-login and registration activity for requests followed by unexpected privileged sessions, invalidate affected sessions, reset credentials and mobile authentication state, remove unauthorized accounts, and investigate administrator actions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.