CVE-2026-8994

Vulnerability

The ajaxLoginWithNear() function in the Login with NEAR plugin (all versions up to and including 0.3.3) is registered as a wp_ajax_nopriv action, making it accessible to unauthenticated users. The function accepts an attacker-supplied account POST parameter and, after a simple substring check for .near, derives a user email as @near.org via getUserEmailByAccount() [1][2][3][4]. It then looks up a WordPress user by that email; if found, it immediately sets an authentication cookie for that user without any nonce verification, cryptographic signature, or proof of wallet ownership. If no user exists, it creates a new WordPress account with the derived email and authenticates it [1][2][3][4].

Exploitation

An unauthenticated attacker can send a POST request to the WordPress AJAX endpoint with the action parameter set to the plugin's AJAX action and an account parameter containing any string ending with .near (e.g., admin@example.com.near). The plugin strips tags and trims the input, then constructs the email @near.org. If a WordPress user already has that email (e.g., admin@example.com.near@near.org), the attacker is logged in as that user. No authentication, nonce, or cryptographic challenge is required [1][2][3][4].

Impact

Successful exploitation allows an unauthenticated attacker to log in as any existing WordPress user whose email matches the deterministic pattern, including administrators. This grants full administrative access to the WordPress site. Additionally, if no matching user exists, the plugin automatically creates a new WordPress account for the attacker-controlled identifier, enabling unauthorized account creation and potential further abuse [1][2][3][4].

Mitigation

As of the publication date (2026-05-27), no fixed version has been released. The plugin is vulnerable up to and including version 0.3.3. Users should disable the plugin until a patched version is available. There is no known workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at this time.