WordPress DoLogin Plugin Authentication Bypass via Weak Token Randomness

The DoLogin Security plugin for WordPress versions up to 4.3 contains a critical authentication bypass vulnerability stemming from insufficient entropy in magic-link token generation. The vulnerability exploits the `rrand()` function, which seeds PHP's Mersenne Twister with only microsecond-precision values (~20 bits of entropy) rather than cryptographically secure random sources. This allows attackers to predict or brute-force the 32-character authentication tokens used for passwordless login, effectively bypassing the plugin's primary security mechanism. Organizations using this plugin for WordPress authentication are at immediate risk of unauthorized account access, as threat actors can forge valid magic links without credentials.

While this CVE does not map to specific MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect the underlying attack patterns associated with credential access and initial access exploitation. A practitioner reviewing Casky findings would identify indicators including: weak cryptographic implementations in authentication workflows, predictable token generation patterns, and brute-force attack feasibility against magic-link endpoints. Claude's extended reasoning capabilities would correlate these findings with CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) to reveal how attackers could systematically forge authentication tokens by replaying microtime values or enumerating the constrained seed space. Practitioners would see detection patterns flagging authentication token generation processes that rely on time-based seeding rather than `/dev/urandom` or `random_bytes()`, enabling proactive remediation before exploitation.