The Login with NEAR WordPress plugin contains an authentication bypass that permits unauthenticated attackers to authenticate as any existing user or automatically create a new user by sending a POST request to the ajaxLoginWithNear() handler. The plugin validates the supplied account parameter by simply checking for the string ".near" and issues a WordPress authentication cookie without nonce verification, cryptographic signature, or proof that the requester controls the associated NEAR wallet, violating fundamental authentication controls. Classified as CWE‑287, this flaw allows attackers to obtain full access to the site and its content.

All installations of the LearnNearClub Login with NEAR plugin for WordPress with version 0.3.3 or earlier are affected. Sites that have the plugin enabled are at risk until the plugin is updated or removed.

The CVSS score of 8.1 indicates high severity. Exploitation is remote and requires only a crafted HTTP POST to an unauthenticated wp_ajax endpoint; no authentication, nonce, or permissions are needed. The endpoint is publicly reachable, making bypass trivial for malicious actors. The absence of a KEV listing does not mitigate the risk; the vulnerability remains a viable exploit vector.