What is the CVSS score of CVE-2026-3461?

CVE-2026-3461 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-3461?

Visa Acceptance Solutions WordPress plugin versions through 2.1.0 contain a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated attackers to take over any user…

How to fix or mitigate CVE-2026-3461?

Within 24 hours: Disable or remove the Visa Acceptance Solutions WordPress plugin from all production environments immediately; audit access logs for suspicious guest checkout activity and confirm no unauthorized account access has occurred. Within 7 days: Contact Visa or the plugin vendor to confirm patch availability and expected release timeline; if patch is released, test in staging environment before deployment. Within 30 days: Apply vendor-released patch to all installations; conduct password reset for all user accounts as a precautionary measure; implement Web Application Firewall rules to block suspicious guest checkout requests if patch remains unavailable.

WordPress CVE-2026-3461

EUVD-2026-22853 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-15 Wordfence

Authentication Bypass WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 09:08 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22853

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

CRITICAL 9.8

DescriptionCVE.org

The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the express_pay_product_page_pay_for_order() function logging users in based solely on a user-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by providing the target user's email address in the billing_details parameter, resulting in complete account takeover and site compromise.

AnalysisAI

Authentication bypass in Visa Acceptance Solutions WordPress plugin (all versions through 2.1.0) allows unauthenticated remote attackers to gain complete account takeover by providing any user's email address during guest checkout. The vulnerability enables login as any existing user, including administrators, without password verification or email ownership validation. With a CVSS score of 9.8 (critical) and attack complexity of Low, this represents an immediate exploitation risk requiring no user interaction or privileges, though no public exploit or active exploitation (KEV) has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the express_pay_product_page_pay_for_order() function within the Visa Acceptance Solutions payment gateway plugin for WordPress (CPE: cpe:2.3:a:visaacceptancesolutions:visa_acceptance_solutions). The flaw is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), where the plugin implements a fundamentally insecure authentication mechanism during guest checkout for subscription products. Source code inspection (lines 777 and 790 in class-visa-acceptance-payment-gateway-expresspay-public.php) reveals the function accepts a user-supplied billing_details parameter containing an email address and directly logs in the corresponding WordPress user account without implementing any of the standard authentication controls: no password verification, no email ownership validation via confirmation tokens, and no one-time use nonces. This represents a complete failure of the authentication boundary, allowing arbitrary user impersonation through a simple API parameter manipulation during the checkout process.

RemediationAI

Site administrators should immediately disable the Visa Acceptance Solutions plugin until a patched version addressing this authentication bypass is released by the vendor. No vendor-released patch fixing CVE-2026-3461 has been identified at time of analysis, and the trunk version in the WordPress plugin repository still contains the vulnerable code at the documented locations. As an interim mitigation, administrators can disable guest checkout functionality for subscription products if business requirements permit, though this does not eliminate the vulnerability if the plugin remains active. Monitor the WordPress plugin repository and vendor communications for security updates. Once a patched version is released, update immediately and audit user accounts for suspicious authentication activity, particularly administrator account logins coinciding with checkout processes. Review access logs for unusual billing_details parameter usage patterns. For sites requiring payment processing continuity, consider temporarily migrating to an alternative payment gateway plugin with verified secure authentication practices. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3aea10-d7a0-44bd-94dc-3bad0d27dbd8 for updates on patch availability and additional mitigation guidance.