CVE-2026-14495 affects the DoLogin Security WordPress plugin through insufficient randomness in its passwordless login token generation. The plugin seeds the Mersenne Twister PRNG with only about 20 bits of entropy derived from the microseconds component of the current time, making the 32-character magic-link token deterministic and guessable. The authentication bypass occurs because the plugin verifies the token using a non-constant-time comparison and directly sets authentication cookies without triggering lockout mechanisms. Exploitation requires a valid, unexpired passwordless login link (valid up to 7 days) and knowledge or guessability of the auto-increment numeric link ID. This vulnerability allows an unauthenticated attacker to brute-force the seed space (~10^6 possibilities) to impersonate any user, including administrators.

Successful exploitation enables an unauthenticated attacker to bypass authentication and gain access to any user account, including administrative accounts, without a password. This compromises confidentiality, integrity, and availability of the affected WordPress site. The attacker can fully impersonate targeted users, potentially leading to site takeover or data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should disable the passwordless login feature or the DoLogin Security plugin entirely to prevent exploitation. Monitoring for suspicious login activity related to passwordless tokens is advised. Do not rely on the plugin's current authentication mechanism for security.