CVE-2026-3461 is an authentication bypass vulnerability in the Visa Acceptance Solutions WordPress plugin (versions up to 2.1.0). The vulnerability arises because the function express_pay_product_page_pay_for_order() logs users in based solely on a user-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. This allows unauthenticated attackers to impersonate any existing user by providing their email address in the billing_details parameter, leading to full account takeover and site compromise. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Successful exploitation enables unauthenticated attackers to gain full access to any user account, including administrator accounts, resulting in complete site compromise. This can lead to unauthorized actions, data theft, and control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin or disable it if possible. Monitor for updates from the vendor and apply patches immediately once available. Avoid relying on the vulnerable functionality for guest checkout with subscription products.