CVE-2026-3461
Published: 15 April 2026
Summary
CVE-2026-3461 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-3461 is an authentication bypass vulnerability in the Visa Acceptance Solutions plugin for WordPress, affecting all versions up to and including 2.1.0. The flaw originates in the `express_pay_product_page_pay_for_order()` function, which automatically logs in users during guest checkout for subscription products based solely on a user-supplied billing email address. This occurs without verifying email ownership, requiring a password, or validating a one-time token.
Unauthenticated attackers can exploit the vulnerability remotely with low complexity and no privileges by submitting the target user's email address in the billing_details parameter during the affected checkout process. Successful exploitation grants login access as any existing user, including administrators, enabling complete account takeover and full site compromise. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
References to the vulnerability include code excerpts from the WordPress plugin trac repository, pinpointing lines 777 and 790 in public/class-visa-acceptance-payment-gateway-expresspay-public.php for both the tagged 2.1.0 release and the trunk branch. The Wordfence threat intelligence advisory provides additional details on the issue via its vulnerability ID page.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22853
Vulnerability details
The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the `express_pay_product_page_pay_for_order()` function logging users in based solely on a user-supplied billing email address during guest…
more
checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by providing the target user's email address in the billing_details parameter, resulting in complete account takeover and site compromise.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for unauthenticated remote account takeover.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Explicitly authorizes and limits actions performable without identification or authentication, directly preventing the plugin's automatic login based solely on unverified user-supplied email during guest checkout.
Requires identification and authentication of non-organizational users before granting access to systems like WordPress sites, countering the bypass that logs in users without verifying credentials or email ownership.
Enforces approved authorizations for logical access, addressing the failure to require proper authentication before granting user sessions in the vulnerable checkout function.