CVE-2026-14495: WordPress DoLogin Security Auth Bypass

CVE-2026-14495 Overview

CVE-2026-14495 is an authentication bypass vulnerability in the DoLogin Security plugin for WordPress affecting all versions up to and including 4.3. The flaw resides in the dologin\s::rrand() function, which seeds PHP's Mersenne Twister with predictable input to generate passwordless login tokens. An unauthenticated attacker can brute-force the constrained seed space to reconstruct a valid magic-link token and authenticate as any targeted user, including administrators. The weakness is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact

An unauthenticated attacker can hijack active passwordless login sessions and gain administrator access without a password, provided a valid login link exists for the target account.

Affected Products

• DoLogin Security plugin for WordPress
• All versions up to and including 4.3
• WordPress sites with active passwordless login links issued within the 7-day validity window

Discovery Timeline

• 2026-07-08 - CVE-2026-14495 published to NVD
• 2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14495

Vulnerability Analysis

The DoLogin Security plugin generates 32-character passwordless login tokens using the Mersenne Twister PRNG. The dologin\s::rrand() function seeds the generator with mt_srand((double) microtime() * 1000000), which discards the integer-seconds component of microtime(). This constrains the seed to approximately 10^6 candidate values, yielding roughly 20 bits of entropy. Each character of the token is then drawn sequentially from mt_rand(), making the entire token a deterministic function of the seed.

Root Cause

The vulnerability stems from two compounding weaknesses. First, Pswdless::try_login() is registered on the unauthenticated init hook and resolves the target account by an auto-increment numeric ID embedded in the ?dologin=<id>.<hash> parameter. Second, the handler performs the token comparison using the non-constant-time != operator and calls wp_set_auth_cookie() directly. The login flow never passes through wp_authenticate(), so the plugin's own Auth::_has_login_err() lockout is never triggered.

Attack Vector

An attacker enumerates the numeric ID space or guesses the auto-increment primary key of a target passwordless link. The attacker then brute-forces the ~10^6-value seed space, deterministically regenerating candidate 32-character tokens with mt_rand(). For each candidate, the attacker submits ?dologin=<id>.<hash> to the site. Because no lockout applies, the attacker can iterate until a matching token authenticates them as the targeted user. Exploitation requires that a valid, unexpired passwordless login link exists for the target account, with links remaining active for up to 7 days.

See the Wordfence Vulnerability Report and the WordPress plugin source at pswdless.cls.php#L197 for the vulnerable code paths.

Detection Methods for CVE-2026-14495

Indicators of Compromise

• High-volume HTTP GET requests to site root containing the ?dologin=<id>.<hash> query parameter from a single source IP.
• Sequential enumeration of the numeric ID component in ?dologin= requests, indicating auto-increment ID probing.
• Successful wp_set_auth_cookie events for administrator accounts without a preceding wp_login form submission.
• New administrator sessions originating from IPs with no prior authenticated activity.

Detection Strategies

• Alert on any request containing the dologin= query parameter where the request rate from a single client exceeds normal user behavior.
• Correlate WordPress authentication cookie issuance with the absence of wp-login.php POST requests from the same session.
• Monitor web server logs for large volumes of 302 redirects or 200 responses tied to ?dologin= URLs with varying hash values.

Monitoring Recommendations

• Ingest WordPress access logs and authentication events into a centralized log platform for correlation and retention.
• Track administrator login events and flag any login not preceded by a standard wp-login.php authentication flow.
• Baseline normal traffic to passwordless login endpoints and alert on statistical deviations consistent with brute-force enumeration.

How to Mitigate CVE-2026-14495

Immediate Actions Required

• Disable or uninstall the DoLogin Security plugin on all WordPress instances until a patched version is available.
• Invalidate all outstanding passwordless login links by clearing the plugin's login token storage in the database.
• Force a password reset and session invalidation for administrator accounts that have used passwordless login within the last 7 days.
• Restrict access to WordPress admin URLs by IP allowlist at the web server or WAF layer.

Patch Information

At the time of publication, all versions up to and including 4.3 are affected. Monitor the DoLogin plugin repository on WordPress.org and the Wordfence Vulnerability Report for a fixed release. Apply the patched version as soon as it is published by the plugin author.

Workarounds

• Deploy a WAF rule that blocks or rate-limits requests containing the dologin= query parameter to no more than a few requests per minute per source IP.
• Disable the passwordless login feature within the plugin configuration if the feature is not required.
• Require multi-factor authentication for all WordPress administrator accounts so that a stolen session cookie alone cannot grant full access.
• Reduce the passwordless link validity window from the default 7 days to the shortest operationally acceptable value.