CVE-2026-14495: The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists bec

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand() seeds the Mersenne Twister with mt_srand((double) microtime() * 1000000) — discarding the integer-seconds component of microtime() and constraining the seed to a range of approximately 10^6 values (~20 bits of entropy) — after which every character of the 32-character magic-link token is drawn sequentially with mt_rand(), making the entire token a deterministic function of that seed. Because Pswdless::try_login() is registered on the unauthenticated init hook, resolves the target account by the auto-increment numeric ID embedded in the ?dologin=<id>.<hash> parameter, performs the hash comparison using a non-constant-time != operator, and then calls wp_set_auth_cookie() directly — never passing through wp_authenticate() and therefore never triggering the plugin's own Auth::_has_login_err() lockout — an unauthenticated attacker can brute-force the ~10^6-candidate seed space to reconstruct an active passwordless login token and authenticate as any targeted user, including administrators, without a password. Exploitation requires that a valid, unexpired passwordless login link (active for up to 7 days) exists for the target account at the time of the attack, and that the numeric link ID is known or guessable from the auto-increment primary key.