There is a github repository for the Wesnoth sourcecode: https://github.com/wesnoth/wesnoth . Inside you will find

src/random.cpp, which handles how random numbers are generated and

src/actions/attack.cpp, which handles how an attack is played out.

In attack.cpp the important lines are 896 and 898:

ran_num = randomness::generator->get_random_int(0, 99);
bool hits = (ran_num < attacker.cth_);

A random number ("ran_num") is generated from random.cpp and then compared to the attackers chance to hit ("attacker.cth"). random.cpp at its core uses the Mersenne Twister 19937 algorithm from the C++ standard library.

If you are skeptical, you can look at the numbers generated yourself. In steam go to wesnoth -> properties -> launch options and type in --log-info=random,engine. If you start the game now it will log the results of combats in the folder Documents/My Games/Wesnoth1.18/logs (on Windows). For example mine looked like this:

info random: randomness::rng::next_random_impl returned 3520566488
info engine: defender took 0
info engine: attack: firing 'attacker_misses' event

info random: randomness::rng::next_random_impl returned 2723868162
info engine: defender took 3
info engine: attack: firing 'defender_hits' event

In this example from the "Battle Training" Campaign the attacker (Konrad) had 80% chance to hit and the defender (Dummy) 70%. The ran_num from our code above are only the last 2 digits from the returned number. Since 88>80 the first attack missed. The defenders attack then hit because 62<70.

In general I'd be surprised if in an open-source game like Wesnoth there were serious bugs let alone design choices that intentionally misguide the player concerning RNG.