CVE-2026-3461: Visa Acceptance Solutions WordPress Plugin Authentication Bypass via Guest Checkout
CVE-2026-3461 affects the Visa Acceptance Solutions plugin for WordPress in all versions up to and including 2.1.0. According to the record, guest checkout for subscription products can log a user in based only on a billing email address, allowing an unauthenticated party to take over existing accounts, including administrators. The record lists a CVSS 3.1 base score of 9.8 (critical), no fixed version, and no confirmed exploitation in the sources consulted.
Overview
CVE-2026-3461 is an authentication bypass in the Visa Acceptance Solutions plugin for WordPress. According to the record, the plugin logs a user in during guest checkout for subscription products based only on a billing email address, without proof of email ownership, a password, or a one-time token. The weakness is classified as CWE-288.
Impact
- According to the record, an unauthenticated party could log in as any existing user, including administrators.
- Account takeover could lead to complete compromise of the WordPress site.
- The record rates the issue critical, with a CVSS 3.1 base score of 9.8, reflecting network reachability, no privileges required and no user interaction.
Affected products and versions
- Product: Visa Acceptance Solutions plugin for WordPress.
- Versions: the record states all versions up to and including 2.1.0.
- The structured affected and fixes fields in the record are empty, so precise version boundaries should be confirmed with the vendor and the plugin repository.
Exploitation status
The record does not list this vulnerability in CISA's Known Exploited Vulnerabilities catalog, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS data in the record gives an estimated exploitation probability of about 0.84 percent, at roughly the 57th percentile.
Remediation and mitigation
- No fixed version is identified in the available data. Check the plugin listing and vendor communications for an updated release and apply it once it is verified.
- If no fix is confirmed, consider deactivating the plugin or disabling guest checkout for subscription products until the issue is resolved.
- Review administrator and other privileged accounts, reset credentials where suspicious activity is found, and enforce strong authentication for administrative logins.
- Keep WordPress core, plugins and themes updated, and remove plugins that are not in use.
Detection guidance
- Review web server and WordPress authentication logs for administrator logins that do not match known sessions, especially near subscription checkout activity.
- Look for newly created administrator users, unexpected role changes, and password resets not initiated by the account owner.
- Monitor checkout traffic for unusual volumes of guest orders tied to existing customer email addresses.
Limitations of the available information
- The record does not include a vendor advisory, a fixed version, or exploitation telemetry.
- The source status is recorded as Deferred, and the record does not explain what that status means.
- The EPSS date in the record is later than the publication date, so the EPSS values should be treated as a snapshot from the record only.
- Sources consulted: NVD entry and Wordfence entry.
Frequently asked questions
Is this vulnerability being actively exploited?
The record does not list it in CISA's Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record states all versions up to and including 2.1.0 of the Visa Acceptance Solutions plugin for WordPress.
Is a fixed version available?
The record does not identify a fixed version. Check the vendor and the plugin listing for an update and consider disabling guest checkout for subscriptions until a fix is confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.