CVE-2026-3461 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: April 15, 2026
Visa Acceptance Solutions WordPress Plugin - Authentication Bypass
Published: April 15, 2026Updated: April 15, 2026Remote Exploitable
Overview
Visa Acceptance Solutions WordPress plugin <= 2.1.0 contains an authentication bypass caused by logging in users based solely on user-supplied billing email during guest checkout without verification, letting unauthenticated attackers take over any account including administrators, exploit requires no authentication.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Unauthenticated attackers can fully take over any user account, including administrators, leading to complete site compromise.
Mitigation
Update to the latest version beyond 2.1.0.
References
- https://plugins.trac.wordpress.org/browser/visa-acceptance-solutions/tags/2.1.0/public/class-visa-acceptance-payment-gateway-expresspay-public.php#L777
- https://plugins.trac.wordpress.org/browser/visa-acceptance-solutions/tags/2.1.0/public/class-visa-acceptance-payment-gateway-expresspay-public.php#L790
- https://plugins.trac.wordpress.org/browser/visa-acceptance-solutions/trunk/public/class-visa-acceptance-payment-gateway-expresspay-public.php#L777
- https://plugins.trac.wordpress.org/browser/visa-acceptance-solutions/trunk/public/class-visa-acceptance-payment-gateway-expresspay-public.php#L790
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3aea10-d7a0-44bd-94dc-3bad0d27dbd8?source=cve
Related Resources
Details
- CVE ID
- CVE-2026-3461
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_authentication
- Status
- new
CWE
- CWE-288
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H