Authora : Easy login with mobile number
Authora : Easy login with mobile number has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Incorrect Privilege Assignment, behind 1 of the records (100%).
The one issue recorded for Authora : Easy login with mobile number has a vendor fix available, so running the current release closes it.
All of these findings were reported by 0xBassia. The current release is tested up to WordPress 7.0.4.
CVE-2026-14561Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation
Read the full analysisVulnerability Records

Authora : Easy login with mobile number
Author
authora
Authora Authora is a lightweight and developer-friendly WordPress plugin that enables users to log in using just their mobile number — no passwords, no emails, no hassle. It provides a modern, secure, and user-friendly passwordless login experience for WordPress websites, using OTP (One-Time Password) verification via SMS. Features: Passwordless Login Login with mobile number only Automatic sending of verification code (OTP) via SMS Automatic registration on first login (if no account) Compatible with popular WordPress themes and plugins Why Authora? In today’s world, users are tired of lengthy registration and login forms. Authora provides a fast and enjoyable experience, especially for WooCommerce stores, membership sites, and websites that want to make the login process simpler and more secure. External services This plugin connects to external SMS service providers to send verification codes. The following data is sent to these services: Mobile number: The user’s mobile phone number for sending SMS verification codes. Verification code: A randomly generated numeric code for authentication. API credentials: Your configured API keys and settings for the selected SMS provider. The plugin supports the following SMS providers: API Endpoints: SMS.ir – https://api.sms.ir/v1/send/verify IPPanel Infrastructure https://api2.ippanel.com/api/v1/sms/pattern/normal/send Faraz SMS Shahvar Payam All communications with external services are done securely over HTTPS. The plugin does not store or transmit any personal data beyond what is necessary for SMS delivery. How can I get support? For support, you can visit the plugin’s GitHub page: https://github.com/Rayiumir/Authora
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C