Description
The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the `express_pay_product_page_pay_for_order()` function logging users in based solely on a user-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by providing the target user's email address in the billing_details parameter, resulting in complete account takeover and site compromise.
INFO
Published Date :
2026-04-15T08:28:15.223Z
Last Modified :
2026-04-15T15:50:14.969Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-3461 vulnerability.
| Vendors | Products |
|---|---|
| Visaacceptancesolutions |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-3461.
