VULNERABILITY INTELLIGENCE
CVE-2026-14561
CVSS score6.5 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-08-01
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287