CVE-2026-8994 Overview
CVE-2026-8994 is an authentication bypass vulnerability in the Login with NEAR plugin for WordPress, affecting all versions up to and including 0.3.3. The flaw resides in the ajaxLoginWithNear() function, registered as a wp_ajax_nopriv action and reachable by unauthenticated users. The handler issues a valid WordPress authentication cookie based solely on a substring check for .near in the attacker-supplied account parameter. No nonce verification, cryptographic signature validation, or challenge-response exchange occurs. Attackers can authenticate as any existing WordPress user, including administrators, whose email follows the <account>@near.org pattern. The vulnerability is classified under [CWE-287].
Critical Impact
Unauthenticated attackers can log in as any WordPress administrator and gain full site control.
Affected Products
- WordPress Login with NEAR plugin versions ≤ 0.3.3
- WordPress sites with the near-login plugin active
- Administrator accounts using <account>@near.org email patterns
Discovery Timeline
- 2026-05-27 - CVE-2026-8994 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8994
Vulnerability Analysis
The vulnerability stems from a broken authentication flow in UserLoginController.php. The ajaxLoginWithNear() function is registered as both wp_ajax and wp_ajax_nopriv, exposing it to unauthenticated HTTP requests. When invoked, the handler reads the account POST parameter and performs a string check confirming the value contains .near. The handler then constructs a deterministic email address using the <account>@near.org template and authenticates the matching WordPress user by issuing a session cookie via wp_set_auth_cookie().
No cryptographic proof of wallet ownership is required. The plugin never validates a signed challenge, never verifies a nonce, and never confirms that the requester controls the corresponding NEAR Protocol wallet. If the derived email matches an existing user, the attacker is authenticated as that user. If no matching account exists, the handler creates a new WordPress user under the supplied identifier and authenticates the attacker into that newly created account.
Root Cause
The root cause is missing authentication verification [CWE-287]. The plugin treats a syntactic substring match as proof of identity. Wallet-based authentication requires a signed challenge demonstrating control of the private key. This implementation omits that step entirely.
Attack Vector
An unauthenticated attacker sends a crafted POST request to wp-admin/admin-ajax.php with action=loginWithNear and an account value matching a known administrator's NEAR identifier. The server returns a valid authentication cookie. The attacker uses the cookie to access the WordPress administrative dashboard with full privileges.
No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Near Login source code for technical details.
Detection Methods for CVE-2026-8994
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=loginWithNear from unexpected source IPs
- Successful authentication events for administrator accounts without preceding wp-login.php activity
- Creation of new WordPress users with email addresses ending in @near.org outside normal onboarding
- Session cookies issued to clients that never completed a wallet signature exchange
Detection Strategies
- Inspect web server access logs for admin-ajax.php requests carrying loginWithNear action parameters
- Correlate WordPress user_login audit events with the absence of standard login form submissions
- Alert on privilege escalation patterns where newly authenticated administrators perform plugin or theme modifications
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture authentication and user-creation events
- Monitor for unexpected administrator logins from foreign or anonymizing IP ranges
- Track plugin file integrity for near-login directory changes pending vendor patch release
How to Mitigate CVE-2026-8994
Immediate Actions Required
- Deactivate and remove the Login with NEAR plugin from all WordPress installations until a fixed version is released
- Audit existing WordPress users for unauthorized accounts containing @near.org email addresses
- Force password resets and invalidate active sessions for all administrator accounts
- Review recent administrative actions for unauthorized plugin installs, theme edits, or option changes
Patch Information
At the time of publication, no patched version above 0.3.3 is referenced in the advisory. Monitor the Wordfence Vulnerability Report and the plugin repository for an official fix.
Workarounds
- Remove the plugin entirely from production WordPress instances
- Block requests to admin-ajax.php carrying the loginWithNear action at the web application firewall layer
- Restrict access to wp-admin paths by source IP allowlist where feasible
# Example WAF rule blocking the vulnerable AJAX action
# ModSecurity rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1026899401,msg:'Block CVE-2026-8994 loginWithNear'"
SecRule ARGS:action "@streq loginWithNear"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
