CVE-2026-14495: DoLogin Security WordPress Plugin Authentication Bypass—Passwordless Token Prediction

Technical summary

CVE-2026-14495 exploits three compounding weaknesses in the DoLogin Security plugin (versions ≤4.3). First, the random number generator in `dologin\s::rrand()` seeds the Mersenne Twister with `mt_srand((double) microtime() * 1000000)`, which truncates `microtime()` output and yields only ~20 bits of entropy—approximately 1 million possible seed values. Second, the 32-character magic-link token is generated sequentially using `mt_rand()` without any additional salt or cryptographic mixing, making it entirely deterministic given the seed. Third, the `Pswdless::try_login()` handler—registered on the unauthenticated `init` hook—resolves accounts by auto-increment numeric ID from the `?dologin=<id>.<hash>` parameter, performs token validation using non-constant-time string comparison (`!=`), and directly calls `wp_set_auth_cookie()` without invoking `wp_authenticate()`, thereby circumventing the plugin's own brute-force lockout mechanism (`Auth::_has_login_err()`). An attacker with knowledge of a valid account ID and an active passwordless link can enumerate the seed space to recover the token and authenticate as that user.

Business impact

Organizations using the DoLogin Security plugin face complete account takeover risk for any user with an active passwordless login link. This includes WordPress administrators, editors, and any account that has generated a magic-link token in the past 7 days. An attacker who gains administrative access can modify site content, install malware, exfiltrate sensitive data, modify user permissions, or disable the site entirely. The attack requires no valid credentials and leaves minimal audit trail if login attempt logging is not separately configured. For multi-user sites or those handling sensitive content, this vulnerability enables lateral privilege escalation and data breach scenarios.

Affected systems

DoLogin Security plugin for WordPress, all versions up to and including 4.3. The vulnerability is authentication-centric and affects any WordPress installation using this plugin. Sites running newer patched versions are not affected. The attack surface is limited to users for whom a valid, unexpired passwordless login link exists at the time of the attack; however, since tokens remain valid for up to 7 days, the window of opportunity is substantial.

Exploitability

Exploitation is straightforward: an attacker with network access (CVSS:AV:N) requires only public information (the account numeric ID, often sequentially guessable from published content or user directory enumeration) and an active passwordless link for the target account. The attack is non-interactive (UI:N) and can be executed by an unauthenticated attacker (PR:L reflects the CVSS model, but in practice PR:N is the practical scenario). Brute-forcing ~1 million seeds on a modern system takes seconds. The plugin is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the ease of exploitation and high impact make it attractive for targeted attacks. Public disclosure will accelerate real-world abuse.

Remediation

Upgrade the DoLogin Security plugin to a patched version that addresses the random number generation weakness. Verify against the vendor's advisory for the specific safe version number. Until patching is possible, disable passwordless login functionality or implement network-level controls to restrict access to the WordPress login endpoint. Additionally, implement robust login attempt rate-limiting and monitoring on the `init` hook to detect repeated failed authentication attempts.

Patch guidance

Update the DoLogin Security plugin through the WordPress admin dashboard or via command line (`wp plugin update dologin-security`). Consult the official plugin security advisory or the vendor's release notes to confirm the patched version number and verify that the fix properly seeds the random number generator with cryptographically sufficient entropy (e.g., using `wp_rand()` or `random_bytes()`) and implements constant-time token comparison. After updating, verify that the new version is active and test passwordless login functionality to confirm it still works as expected.

Detection guidance

Monitor WordPress access logs for repeated `dologin` parameter values, unusual spike in passwordless login attempts, or successful authentication from unexpected IP addresses immediately after a burst of failed attempts. Check for `wp_set_auth_cookie()` calls without corresponding `wp_authenticate()` calls in the request context. Review plugin version numbers in `wp-content/plugins/dologin-security/` or via `wp plugin list`. Implement a Web Application Firewall rule to alert on brute-force patterns against the `init` hook. Set up alerts for new administrator user creation or privilege escalation events shortly after passwordless login activity.

Why prioritize this

This vulnerability warrants immediate remediation because it enables unauthenticated account takeover of any user with an active passwordless link, including site administrators. The attack requires minimal sophistication, no valid credentials, and leaves a small forensic footprint. The 8.8 CVSS score reflects high impact (confidentiality, integrity, availability all compromised) and ease of exploitation. Sites using this plugin should patch before public weaponization occurs.

Risk score, explained

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8 (HIGH). Network-accessible attack vector, low attack complexity, and no user interaction drive exploitability. The PR:L constraint is a CVSS model artifact (the vulnerable endpoint is unauthenticated, but the attacker must have network access to reach it); practical scenarios have lower barriers. High impact across confidentiality, integrity, and availability reflects admin-level account compromise. The limited requirement for an active link (time-bound, but 7-day window) is reflected in attack complexity rather than severity.

Frequently asked questions