Authentication bypass in Authora : Easy login with mobile number WordPress plugin

Successful exploitation allows unauthenticated takeover of any account associated with a known registered mobile number, including administrator accounts. This can lead to full compromise of the affected WordPress site through administrative access, including modification of site content, installation of malicious plugins or backdoors, creation of additional privileged users, and access to sensitive site data. The vulnerability also enables unauthorized creation of arbitrary accounts, which can be used for persistence or further privilege abuse depending on site configuration.

If immediate patching is not possible, disable the plugin or specifically disable its mobile-number one-time-code authentication and registration functionality until an updated version can be deployed. Restrict public access to the affected authentication endpoints where feasible, monitor for anomalous logins and unexpected account creation, and enforce additional controls such as limiting administrator access paths and reviewing authentication logs. Because exploitation is unauthenticated and relies only on knowledge of a registered mobile number, mitigation short of patching should be treated as temporary and incomplete.

Update the Authora : Easy login with mobile number WordPress plugin to version 1.7.7 or later, which addresses the exposure of the one-time login code and verification token. Verify that the mobile-number login and registration workflow no longer returns authentication secrets to unauthenticated clients. Review user accounts for unauthorized account creation and audit administrator accounts and plugin changes for signs of compromise if the vulnerable version was exposed.