Authentication Bypass in Visa Acceptance Solutions Plugin for WordPress

CVE-2026-3461

What is CVE-2026-3461?

The Visa Acceptance Solutions plugin for WordPress has a significant security flaw that allows unauthenticated attackers to log in as any user by exploiting the guest checkout process. The plugin's express_pay_product_page_pay_for_order() function improperly logs users in based solely on a user-supplied billing email address, without necessary email ownership verification or password authentication. This creates a pathway for attackers to gain unauthorized access, leading to potential account takeovers and site compromise.

References