CVE-2026-3461: 
WordPress vulnerability analysis and mitigation

CVE-2026-3461 is a critical authentication bypass vulnerability in the Visa Acceptance Solutions plugin for WordPress, affecting all versions up to and including 2.1.0. The flaw allows unauthenticated attackers to log in as any existing user — including administrators — by supplying a target user's email address in the billing details parameter during guest checkout for subscription products. It was first published on April 15, 2026, by the National Vulnerability Database, with a GitHub Advisory (GHSA-f5vm-4j2m-phc2) published on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Specifically, the express_pay_product_page_pay_for_order() function in class-visa-acceptance-payment-gateway-expresspay-public.php (lines 777 and 790) authenticates and logs in a WordPress user based solely on a caller-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. An unauthenticated remote attacker can exploit this by crafting a checkout request with the billing_details parameter set to any registered user's email address, triggering an automatic login as that user. No privileges or user interaction are required, and the attack is executable over the network with low complexity (GitHub Advisory, Wordfence).

Successful exploitation results in complete account takeover for any WordPress user whose email address is known to the attacker, including site administrators. An attacker gaining administrator-level access can fully compromise the WordPress site — installing malicious plugins, exfiltrating sensitive data (user PII, payment information, credentials), defacing content, or establishing persistent backdoors. The high confidentiality, integrity, and availability impact ratings reflect the potential for total site compromise with no recovery path short of full remediation (GitHub Advisory, Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.20–0.38%, placing it in roughly the 60th percentile for exploitation probability within 30 days, reflecting the critical nature of the flaw despite the absence of active exploitation evidence (GitHub Advisory). The vulnerability is detectable by Qualys scanner (detection ID 531163).

1. Reconnaissance: Identify WordPress sites running the Visa Acceptance Solutions plugin (versions ≤ 2.1.0) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/visa-acceptance-solutions/).
2. Enumerate target user emails: Gather registered user email addresses via WordPress username enumeration (e.g., the REST API endpoint /wp-json/wp/v2/users), public author pages, or OSINT techniques.
3. Initiate guest checkout: Navigate to a subscription product page on the target site and begin the guest checkout process to trigger the vulnerable express_pay_product_page_pay_for_order() function.
4. Inject target email: Submit the checkout/pay-for-order request with the billing_details parameter (specifically the billing email field) set to the email address of the target user (e.g., a site administrator).
5. Achieve authentication: The plugin's function processes the request and automatically logs the attacker in as the target user without any password or token verification, granting full session access.
6. Post-exploitation: With administrator access, install a malicious plugin or web shell, exfiltrate data, create a new backdoor admin account, or pivot to other systems accessible from the WordPress environment (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to WooCommerce checkout or pay-for-order endpoints (e.g., /checkout/, /?wc-ajax=checkout, or /checkout/order-pay/) from unauthenticated sessions containing known user email addresses in billing fields.
• Logs: WordPress authentication logs (wp-login.php or equivalent logging plugin output) showing successful logins for administrator or privileged accounts from unexpected IP addresses or without prior password submission; WooCommerce order logs showing guest checkout attempts for subscription products with registered user emails.
• File System: Newly installed or modified plugins/themes not authorized by site administrators; presence of web shells or PHP backdoors in the WordPress uploads or plugin directories.
• Process/Behavior: Unexpected creation of new administrator accounts; changes to site settings, user roles, or installed plugins shortly after a suspicious checkout event; unusual outbound connections from the web server process.

Site administrators should immediately update the Visa Acceptance Solutions plugin to a version beyond 2.1.0 that includes a patch for this vulnerability; a patch was noted as available as of April 22, 2026 (GitHub Advisory). If an immediate update is not possible, the plugin should be deactivated until patching can be completed to eliminate the attack surface. After patching, administrators should review WordPress authentication and WooCommerce order logs for any suspicious activity indicative of prior exploitation, and audit all administrator accounts for unauthorized additions or modifications (Wordfence).

Wordfence, which assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for the period of April 13–19, 2026, highlighting it as a critical authentication bypass requiring immediate attention (Wordfence Blog). No additional notable researcher commentary or broader media coverage has been identified at this time.