The Authora Easy Login with Mobile Number plugin, before version 1.7.7, returns a one‑time login code and an associated verification token in the response to an unauthenticated request. An attacker who knows a user’s registered mobile number can obtain that token, log in as that user—including administrative accounts—and also create arbitrary new accounts without authentication. Because the plugin fails to validate authentication properly (CWE‑287), the flaw permits attackers to bypass authentication and gain unauthorized access.

Any WordPress installation that has the Authora Easy Login with Mobile Number plugin of a version older than 1.7.7 installed is vulnerable. The plugin is commonly found on sites that offer mobile‑number based login or authentication. Upgrading to the latest version (1.7.7 or newer) removes the offending code that leaks OTPs and tokens.

The CVSS score is 6.5, indicating moderate risk. The EPSS score for this vulnerability is reported as < 1% and it is not yet catalogued in CISA’s KEV list, yet the impact is severe because an attacker can assume any user’s identity without entering credentials. The attack vector is unauthenticated, requiring only knowledge of a registered mobile number, which can be discovered through public profiles or social engineering. As the flaw is triggered by a simple, unauthenticated HTTP request, exploitation requires no special software or privileged access, making it highly accessible to attackers.