CVE-2026-14495
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The DoLogin Security plugin for WordPress up to version 4.3 inclusive contains an authentication bypass vulnerability due to insufficient randomness. The `dologin\s::rrand()` function seeds the Mersenne Twister with a microsecond-based seed, limiting entropy to about 20 bits, and then generates a 32-character magic-link token deterministically. An unauthenticated attacker can brute-force the seed space (approximately 10^6 candidates) to reconstruct an active passwordless login token and authenticate as any user, including administrators, without a password.
Risk Assessment
The risk to the organization is critical because an attacker can hijack user accounts, including administrators, without knowing the password, using only the link ID and an existing unexpired passwordless login link (valid for up to 7 days). This could lead to full compromise of the WordPress site.
Recommendation
Immediately update the DoLogin Security plugin to the latest available version that fixes this vulnerability. Until the update is applied, consider temporarily disabling the plugin or restricting access to the passwordless login feature.
Original NVD description (English source)
The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because `dologin\s::rrand()` seeds the Mersenne Twister with `mt_srand((double) microtime() * 1000000)` — discarding the integer-seconds component of `microtime()` and constraining the seed to a range of approximately 10^6 values (~20 bits of entropy) — after which every character of the 32-character magic-link token is drawn sequentially with `mt_rand()`, making the entire token a deterministic function of that seed. Because `Pswdless::try_login()` is registered on the unauthenticated `init` hook, resolves the target account by the auto-increment numeric ID embedded in the `?dologin=<id>.<hash>` parameter, performs the hash comparison using a non-constant-time `!=` operator, and then calls `wp_set_auth_cookie()` directly — never passing through `wp_authenticate()` and therefore never triggering the plugin's own `Auth::_has_login_err()` lockout — an unauthenticated attacker can brute-force the ~10^6-candidate seed space to reconstruct an active passwordless login token and authenticate as any targeted user, including administrators, without a password. Exploitation requires that a valid, unexpired passwordless login link (active for up to 7 days) exists for the target account at the time of the attack, and that the numeric link ID is known or guessable from the auto-increment primary key.