CVE-2026-14495 describes an authentication bypass vulnerability in the DoLogin Security WordPress plugin (versions up to 4.3). The vulnerability arises from insufficient randomness in the generation of passwordless login tokens. The plugin seeds the Mersenne Twister PRNG with a value derived from microtime's fractional seconds only, resulting in approximately 20 bits of entropy. The 32-character magic-link token is then generated deterministically from this seed. Because the login function bypasses standard authentication checks and lockout mechanisms, an attacker can brute-force the limited seed space (~10^6 possibilities) to reconstruct a valid token and authenticate as any user, including administrators, if a valid unexpired login link exists and the numeric ID is known or guessable.

Successful exploitation allows an unauthenticated attacker to bypass authentication and gain access to any targeted user account, including administrator accounts, without needing a password. This compromises confidentiality, integrity, and availability of the affected WordPress site. The attack requires a valid, unexpired passwordless login link and knowledge or guessability of the numeric link ID. The vulnerability can lead to full site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the passwordless login feature or the DoLogin Security plugin entirely to prevent exploitation. Monitoring for suspicious login activity related to passwordless tokens is advised. Avoid exposing or guessing numeric link IDs. Follow vendor updates closely for an official fix.