Authentication Bypass Vulnerability in Login with NEAR Plugin for WordPress

CVE-2026-8994

What is CVE-2026-8994?

The Login with NEAR plugin for WordPress is susceptible to an authentication bypass issue that allows unauthenticated users to gain access to WordPress accounts. This vulnerability arises from the 'ajaxLoginWithNear()' function, which lacks proper nonce verification and relies solely on substring checks for email patterns. Attackers can leverage this to log in as any WordPress user with an email address following a specific format, or even create unauthorized accounts if no matches are found. This poses a significant risk, particularly for administrators, and highlights the need for vigilance in utilizing secure authentication methods.

References