We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Visa Acceptance Solutions Plugin Vulnerability (CVE-2026-3461)

Nick Paliughi
On this page

Security Alert Summary

The Visa Acceptance Solutions plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-3461) present in versions up to and including 2.1.0. A function used during guest checkout for subscription products can log users in based solely on a supplied billing email address without verifying ownership, a password, or a one-time token, allowing an unauthenticated attacker to assume the identity of existing users.

CVE Details

  • CVE ID: CVE-2026-3461
  • Affected component: Visa Acceptance Solutions plugin for WordPress
  • Affected versions: All versions up to and including 2.1.0
  • Published: April 15, 2026 at 9:16:31 AM UTC
  • Last modified: April 15, 2026 at 9:16:31 AM UTC
  • CVSS v3.1: Base Score 9.8, Severity: CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Privileges required: None (PR:N)
  • User interaction: None (UI:N)
  • Primary impact: Confidentiality: High; Integrity: High; Availability: High
  • Authentication/authorization context: Vulnerability enables authentication bypass during guest checkout for subscription products
  • Weakness (CWE): CWE-288

Technical Details

The vulnerability is caused by the express_pay_product_page_pay_for_order() function performing a login based only on a user-supplied billing email address provided during guest checkout for subscription products. The function does not verify that the requester actually owns the email address, does not require a password, and does not validate a one-time token or other proof of ownership. As a result, an attacker who supplies the target user’s email address in the billing_details parameter can be logged in as that user.

Because the check relies solely on an email value supplied by the client, the normal authentication barrier is effectively bypassed. The description indicates this can lead to complete account takeover of existing users, including administrator accounts, which in turn can result in site compromise.

How This Could Impact Your Website

On a site with multiple users—such as a site owner, internal staff (editors or contributors), and external contractors—an attacker could supply a known email address for any existing account during a guest subscription checkout and be authenticated as that user. For example, if an attacker supplies an editor or administrator email address via the billing_details parameter, they could gain that user’s privileges.

Practical consequences include exposure of internal accounts and increased risk of targeted phishing or social engineering using account access. Account takeover of higher-privilege users could allow changes to site content, plugin installation, data access, or other administrative actions consistent with the compromised account’s privileges.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially accounts with contributor, editor, or administrator privileges.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual behavior, such as unexpected logins or changes to administrator accounts.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
MetForm Pro Plugin Vulnerability (CVE-2026-1782)
Next Post
Inquiry Form to Posts or Pages Plugin Vulnerability (CVE-2026-6293)