Use wp_rand() for the network admin email change hash

[ExtremsX]

update_network_option_new_admin_email() in wp-includes/ms-functions.php builds
the email-change confirmation hash with mt_rand():

$hash = md5( $value . time() . mt_rand() );

This is the multisite equivalent of update_option_new_admin_email(). In #43771
([43367]) the single-site admin email hash and the user profile email change
hash were hardened to use wp_rand() instead of mt_rand(). The network version
was missed and still uses mt_rand(). The sibling multisite hashes in the same
file (ms-functions.php:805 and :874) already use wp_rand().

Patch: use wp_rand() for the network admin email hash as well.

See #43771.

Problem

update_network_option_new_admin_email() (wp-includes/ms-functions.php) builds
the email-change confirmation hash with mt_rand():

$hash = md5( $value . time() . mt_rand() );

This is the multisite/network equivalent of the single-site
update_option_new_admin_email(). In #43771 ([43367]) the single-site admin
email hash and the user profile email change hash were both hardened to use
wp_rand() instead of mt_rand(). The network version was not part of that
change and still uses mt_rand(). The sibling multisite hashes in the same file
(ms-functions.php:805 and :874) already use wp_rand().

As johnbillion noted in comment:5 of #43771, md5() here is only a URL-safe
format and not cryptographic; the unpredictability comes from the random value,
so wp_rand() is the correct source.

Fix

Use wp_rand() for the network admin email confirmation hash, bringing it in
line with its single-site counterpart:

$hash = md5( $value . time() . wp_rand() );

One-line change, no behavior change. This is hardening, not an exploitable
issue (same classification as #43771), so it is filed on Trac rather than
HackerOne.

Tests

No dedicated test, matching [43367]: the change only swaps the randomness
source and produces no observable difference in behavior (update_site_option
is still called with a random md5-formatted hash). php -l is clean.

See #43771.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code, with code-intruder (my own static analysis tool)
Model(s): Claude Opus, Claude Haiku
Used for: code-intruder flagged the weak-token pattern (mt_rand reaching a
credential-style hash) and an AI review compared it against the sibling paths
already hardened in [43367], confirming the network version was the one left
using mt_rand. I reviewed and tested the change myself.

[johnjamesjacoby]

In 65115:

Security: Harden the random aspect of the hash used for network admin email changes.

Replace mt_rand() with wp_rand() when generating the network admin email confirmation hash, matching the site admin and user profile email change hashes.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15267

Props extremsx.
Fixes #66426.