Quick Look: CVE-2026-8994 Authentication Bypass in Login with NEAR WordPress Plugin

Introduction

A WordPress plugin built to let users authenticate with their NEAR Protocol cryptocurrency wallets turns out to skip the one step that matters: verifying that the requester owns the wallet. CVE-2026-8994 is an authentication bypass in the Login with NEAR plugin (versions 0.3.3 and below) that lets any unauthenticated attacker log in as an arbitrary WordPress user, including administrators, with a single HTTP POST request.

The Login with NEAR plugin (slug: near-login) is a niche Web3 integration tool that bridges NEAR Protocol wallet authentication into WordPress. A single developer (Learn NEAR Club) published it in December 2022, and the WordPress plugin directory lists fewer than 10 active installations. The installed base is tiny, but the vulnerability is a textbook case of a dangerous pattern we keep seeing in 2026: WordPress authentication plugins that accept identity claims without any cryptographic proof.

Technical Information

Root Cause: Zero Verification of Wallet Ownership

The vulnerability lives in the ajaxLoginWithNear() function within Controllers/UserLoginController.php. This function is registered as a wp_ajax_nopriv_ action, which in WordPress means it is explicitly accessible to unauthenticated users. The entire authentication decision rests on a single substring check:

if (strpos($account, '.near') !== false)

That is the whole of the "authentication" logic. There is no nonce verification, no cryptographic signature validation, no challenge-response exchange with the NEAR blockchain, and no proof that the requester controls the NEAR wallet they claim to own. NEAR Protocol itself provides solid cryptographic signature and challenge-response mechanisms for wallet authentication, but the plugin uses none of them.

How the Attack Works, Step by Step

Step 1: Reaching the unauthenticated endpoint. The function is hooked to wp_ajax_nopriv_login_with_near at line 16 of UserLoginController.php. WordPress routes any AJAX request from a logged-out user with the parameter action=login_with_near straight to this handler.

Step 2: Supplying an arbitrary account name. The function reads $_POST['account'] and passes it through sanitize_text_field() (line 29). This sanitization strips HTML tags but does no identity validation. The attacker can supply any string they choose.

Step 3: Passing the substring check. At line 46, the function checks whether the supplied account string contains .near. Any string containing that substring passes. This is the only gate between an unauthenticated request and a valid WordPress session.

Step 4: Deterministic email derivation. The helper function getUserEmailByAccount() (line 76) concatenates the supplied account name with @near.org to produce an email address. Supplying admin.near, for example, produces [email protected]. The handler then calls get_user_by('email', $email) to look up an existing WordPress user.

Step 5: Hijacking an existing account. If a WordPress user with the derived email address exists, the handler calls wp_set_auth_cookie($user->ID, true), issuing a valid persistent authentication cookie for that user. If the matched user holds an administrator role, the attacker gains full administrative access to the WordPress site.

Step 6: Creating a new rogue account. If no matching user exists, the handler calls wp_create_user($account, wp_generate_password(), $email) to create a brand-new WordPress account, then immediately authenticates it via wp_set_auth_cookie(). The attacker never needs the randomly generated password, because they are already logged in.

The Exploit Request

The whole attack reduces to a single HTTP POST:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=login_with_near&account=<target>.near

Here <target>.near is chosen so that <target>[email protected] matches an existing WordPress user's email address. The attack needs no special tools, no prior authentication, and no user interaction.

CVSS Breakdown

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a score of 8.1 (High).

The High attack complexity rating reflects that the attacker must identify which .near account name maps to an existing WordPress user's email. In practice, that information can often be inferred or enumerated, particularly for administrator accounts.

CWE Classification

This vulnerability is classified as CWE-287: Improper Authentication, defined as: "When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct." The plugin accepts the attacker's claim of NEAR wallet ownership (the account parameter) without any cryptographic or challenge-response proof that the claim is legitimate.

Affected Systems and Versions

The vulnerability affects the Login with NEAR WordPress plugin in all versions up to and including 0.3.3. This is the current stable release. No patched version exists.

Any WordPress site with this plugin installed and activated is vulnerable, regardless of configuration. The vulnerable endpoint (wp_ajax_nopriv_login_with_near) is registered unconditionally when the plugin is active.

Vendor Security History

A single developer (Learn NEAR Club) wrote the Login with NEAR plugin, with no additional contributors listed on the WordPress.org repository. The plugin was last modified on November 10, 2025, roughly 7 months before this vulnerability was disclosed. The low version number (0.3.3), the small codebase (2.5 KB for the vulnerable controller), and the long gap without updates all point to minimal ongoing maintenance.

This vulnerability fits a broader pattern of CWE-287 (Improper Authentication) flaws across WordPress plugins in 2026. Several comparable authentication bypass vulnerabilities have been disclosed this year:

The recurring theme across these vulnerabilities is accepting identity claims without sufficient verification, the exact flaw present in Login with NEAR.

Mitigation

Since no patch exists and the plugin's maintenance status suggests one is unlikely, the main mitigation is complete removal of the Login with NEAR plugin. Deactivating it without deleting leaves the code on the server, where a separate compromise could reactivate it.

Additional steps for sites that may have been exposed:

1. Audit user accounts: Check the wp_users table for accounts with [email protected] email addresses that were not intentionally created. Delete any unauthorized accounts.
2. Reset administrator passwords: If the vulnerability might have been exploited before disclosure, force password resets for all administrative users and review for persistent backdoor access (new admin accounts, modified files, installed plugins).
3. Deploy WAF rules: Wordfence Premium, Care, and Response customers received a firewall rule to block exploitation attempts targeting this specific vulnerability. This gives interim protection while plugin removal is coordinated.
4. Block the specific endpoint: As a defense-in-depth measure, restrict unauthenticated POST requests to wp-admin/admin-ajax.php carrying the action=login_with_near parameter through server-level access controls.

Organizations that require NEAR wallet authentication on WordPress should evaluate alternative implementations that properly use the NEAR blockchain's native cryptographic signature verification, rather than a trivially forged substring check.

Threat Landscape Context

No confirmed active exploitation of CVE-2026-8994 has been reported as of the disclosure date (May 27, 2026). Several factors still make this vulnerability worth tracking.

The exploit is trivial: a single POST request with no specialized tooling. The vulnerable source code is fully visible on the WordPress Trac repository, which gives an attacker everything needed to build a working exploit. VulnCheck's analysis of routinely targeted vulnerabilities in 2026 notes that several CVEs showing no exploitation at disclosure were later observed in the wild. WordPress authentication bypass vulnerabilities are a known target for opportunistic threat actors who run automated scans to find vulnerable plugin installations.

The limited installation base (fewer than 10 active sites) sharply constrains the real-world blast radius. Mass exploitation is unlikely given the tiny target population. Any individual site running this plugin should still treat the risk as immediate, particularly because the attack requires no authentication, no user interaction, and produces no obvious indicators to the site owner.

The larger takeaway for the WordPress security community is the pattern this vulnerability represents. Web3 and blockchain integration plugins are a growing category, and the Login with NEAR flaw shows what happens when a plugin bridges a cryptographically secured system (the NEAR blockchain) into WordPress without implementing any of the cryptographic verification that makes the source system secure. Anyone deploying a Web3 login plugin should confirm that wallet ownership is proven through signed messages or challenge-response exchanges, not string matching.

References

• NVD Entry for CVE-2026-8994
• Wordfence Advisory: Login with NEAR <= 0.3.3 Authentication Bypass
• UserLoginController.php Source Code (WordPress Plugin Trac)
• UserLoginController.php Line 16: Action Registration
• UserLoginController.php Line 29: Account Parameter Handling
• UserLoginController.php Line 46: Substring Check
• UserLoginController.php Line 76: Email Derivation
• Login with NEAR WordPress Plugin Directory Page
• CWE-287: Improper Authentication
• VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities
• Wordfence Blog: 200,000 WordPress Sites at Risk from Critical Authentication Bypass in Burst Statistics
• Wordfence: Temporary Login Authentication Bypass
• Wordfence: Social Login Authentication Bypass
• SentinelOne: CVE-2026-4587 HybridAuth Auth Bypass
• SentinelOne: CVE-2026-1779 WordPress User Registration Auth Bypass