What is CVE-2026-14561?

CVE-2026-14561 is a medium-severity vulnerability in Authora : Easy Login With Mobile Number, classified under Improper Authentication. CVSS score: 6.5/10. Published 2026-08-01.

How severe is CVE-2026-14561?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Authora : Easy Login With Mobile Number

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

Vulnerability class: Broken Authentication

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Unknown Authora : Easy Login With Mobile Number — versions 0

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-14561?: CVE-2026-14561 is a medium-severity vulnerability in Authora : Easy Login With Mobile Number, classified under Improper Authentication. CVSS score: 6.5/10. Published 2026-08-01.
How severe is CVE-2026-14561?: Medium severity. CVSS v3 base score is 6.5 out of 10.