CVE-2026-14561

unknowncovered by 1 sourcefirst seen 2026-08-01

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

⚡ Watch CVE-2026-14561

Get an email if CVE-2026-14561 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-14561: The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its on…nvd · 2026-08-01

External references

NVD record for CVE-2026-14561

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-14561 status](https://www.csirts.com/badge/CVE-2026-14561)](https://www.csirts.com/cve/CVE-2026-14561)