PT-2026-56322 · WordPress · Dologin Security
Published
2026-07-08
·
Updated
2026-07-08
·
CVE-2026-14495
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DoLogin Security versions prior to 4.4
Description
An authentication bypass exists due to insufficient randomness in the generation of passwordless login tokens. The
dologins::rrand() function seeds the Mersenne Twister using a method that constrains the seed to approximately 10^6 values, making the resulting 32-character token deterministic. An unauthenticated attacker can brute-force this seed space to reconstruct a valid token and authenticate as any user, including administrators, without a password. This is possible because the Pswdless::try login() function is registered on the unauthenticated init hook and calls wp set auth cookie() directly, bypassing the wp authenticate() process and the plugin's own lockout mechanism. The attack requires a valid, unexpired passwordless login link to exist for the target account and the numeric link ID to be known or guessable. The vulnerability involves the ?dologin=<id>.<hash> parameter.Recommendations
Update DoLogin Security to a version newer than 4.3.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dologin Security