CVE-2026-3461

OVERVIEW: CVE-2026-3461 is a critical authentication bypass vulnerability in the Visa Acceptance Solutions plugin for WordPress affecting all versions up to and including 2.1.0. The flaw exists in the express_pay_product_page_pay_for_order() function, which logs users in based solely on a guest-supplied billing email address during subscription checkout without verifying email ownership, requiring passwords, or validating authentication tokens. SEVERITY: This vulnerability carries a CVSS score of 9.8 (CRITICAL) with a network-based attack vector requiring no user interaction or special privileges. Exploitation is trivial due to low attack complexity, allowing unauthenticated threat actors to gain unauthorized access to any user account, including administrative accounts, by submitting a target's email address. Successful exploitation results in complete account takeover and potential site-wide compromise. EXPLOITATION STATUS: The vulnerability is currently not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat tracking lists. However, its extreme accessibility and critical severity present significant risk. The EPSS score of 0.002 indicates lower statistical probability of near-term exploitation compared to other CVEs, though this does not diminish the urgency for patching given the ease of exploitation and severity of impact. Organizations should prioritize immediate remediation regardless of current exploitation status.