Authora : Easy login with mobile number

Changelog

1.7.9

• Fix Style Modal Close SVG

1.7.8

• Increase code column from varchar(20) to varchar(255) to fit wp_hash_password output
• Add automatic DB upgrade for existing tables
• Fix nonce action mismatch in enqueue.php
• Add missing nonce to verify form and AJAX request”
• Replace insecure rand() with cryptographically secure random_int() for OTP generation
• Hash OTP codes using wp_hash_password() and verify with wp_check_password()
• Prevent secure token exposure by removing it from the DOM and using JS closure storage
• Add nonce verification to authora_verify to mitigate CSRF attacks
• Add database index on mobile column to improve lookup performance and prevent full table scans
• Remove legacy PHP session-based login system and obsolete login files
• Fix JavaScript scope issues and improve AJAX error handling

1.7.7

Security release — please update as soon as possible.

This release fixes an unauthenticated authentication bypass (account takeover) in the mobile OTP login flow.

• Critical: OTP leak in login response. The authora_login AJAX action previously returned the one-time code (code) and a verification nonce (_wpnonce) directly in its unauthenticated JSON response. An attacker who knew a registered mobile number could request a code, read the code and nonce from the response body, and replay them to authora_verify to obtain a logged-in session as that user — without ever receiving the SMS. Targeting an administrator’s mobile resulted in full site takeover. The response no longer includes the code or any verification nonce.
• Critical: predictable verification nonce. authora_verify trusted a nonce derived from the mobile number (wp_create_nonce( 'verify' . $mobile )) rather than real server-side state, so the leaked nonce validated for anyone. Verification is now bound to an opaque, cryptographically random server-side token that is issued only to the requester and stored server-side.
• Hardening: rate limiting. A per-mobile rate limit (60 seconds) was added to code requests to slow down enumeration and abuse.
• Hardening: brute-force protection. The code is now invalidated after 5 failed verification attempts, and the token/code are cleared on a successful login to prevent reuse/replay.
• Fix: Corrected a latent bug where a database insert failure during code registration was silently swallowed instead of returning an error.

Upgrade note: This version adds two columns (token, attempts) to the authora_login table. They are created automatically via dbDelta on plugin (re)activation. No other configuration is required.

1.7.6

• Security: OTP code and verification nonce are no longer returned in the login response (previously an unauthenticated attacker could read the code and nonce and replay them to log in as any user, including admins).
• Security: verification is now bound to an opaque server-side token returned only to the real requester, instead of a predictable nonce derived from the mobile number.
• Security: added a per-mobile rate limit on code requests and invalidation of the code after 5 failed verification attempts.
• Security: the verification token and OTP are cleared after a successful login to prevent reuse.