Repository navigation
Releases: Authorair/Authora
Releases · Authorair/Authora
Release list
v1.7.9
v1.7.8
Summary
- Increase code column from varchar(20) to varchar(255) to fit wp_hash_password output
- Add automatic DB upgrade for existing tables
- Fix nonce action mismatch in enqueue.php
- Add missing nonce to verify form and AJAX request"
- Replace insecure rand() with cryptographically secure random_int() for OTP generation
- Hash OTP codes using wp_hash_password() and verify with wp_check_password()
- Prevent secure token exposure by removing it from the DOM and using JS closure storage
- Add nonce verification to authora_verify to mitigate CSRF attacks
- Add database index on mobile column to improve lookup performance and prevent full table scans
- Remove legacy PHP session-based login system and obsolete login files
- Fix JavaScript scope issues and improve AJAX error handling
v1.7.7
Summary
This release fixes an unauthenticated authentication bypass (account takeover) in the mobile OTP login flow.
- Critical: OTP leak in login response. The
authora_loginAJAX action previously returned the one-time code (code) and a verification nonce (_wpnonce) directly in its unauthenticated JSON response. An attacker who knew a registered mobile number could request a code, read the code and nonce from the response body, and replay them toauthora_verifyto obtain a logged-in session as that user — without ever receiving the SMS. Targeting an administrator's mobile resulted in full site takeover. The response no longer includes the code or any verification nonce. - Critical: predictable verification nonce.
authora_verifytrusted a nonce derived from the mobile number (wp_create_nonce( 'verify' . $mobile )) rather than real server-side state, so the leaked nonce validated for anyone. Verification is now bound to an opaque, cryptographically random server-side token that is issued only to the requester and stored server-side. - Hardening: rate limiting. A per-mobile rate limit (60 seconds) was added to code requests to slow down enumeration and abuse.
- Hardening: brute-force protection. The code is now invalidated after 5 failed verification attempts, and the token/code are cleared on a successful login to prevent reuse/replay.
- Fix: Corrected a latent bug where a database insert failure during code registration was silently swallowed instead of returning an error.
Upgrade note: This version adds two columns (token, attempts) to the authora_login table. They are created automatically via dbDelta on plugin (re)activation. No other configuration is required.