DoLogin Security for WordPress is susceptible to an authentication bypass because its random number generator is seeded with a truncated microtime value, yielding only about one million possible seeds. The resulting 32‑character magic‑link token is deterministically derived from this seed, and the plugin compares hashes using a non‑constant‑time operator. When an unauthenticated user requests the link via the \"dologin\" URL, the plugin resolves the target account ID, verifies the hash, and calls wp_set_auth_cookie without passing through WordPress’s standard authentication flow. This allows a malicious actor to brute‑force the small seed space, reconstruct a valid token, and log in as any user—including administrators—without knowing a password.

Any WordPress website that has installed the DoLogin Security plugin version 4.3 or earlier is affected. Sites must have at least one active passwordless login link for a user at the time of the attack. Users identified by an auto‑incrementing numeric primary key benefit because the link identifier can be guessed or discovered.

With a CVSS score of 8.8 the vulnerability carries high severity. The EPSS score of less than 1% indicates a low yet non‑negligible probability of exploitation in the wild, and it is currently not listed in the CISA KEV catalog. An attacker can launch the exploit using an unauthenticated HTTP request, guessing or obtaining the numeric link ID, and enumerating the small seed space to produce a valid token. No additional system privileges or network access are required beyond the web interface, so the risk is immediate for any attacker with internet access to the site. The vulnerability bypasses normal password policies and lockout mechanisms, which can enable persistent compromise.