The Visa Acceptance Solutions WordPress plugin contains a flaw that allows an attacker to bypass authentication during guest checkout for subscription products. The express_pay_product_page_pay_for_order() function logs a user in based solely on a supplied billing email address, with no verification of email ownership, password, or one‑time token. An unauthenticated attacker can provide any existing user’s email in the billing_details parameter, causing the system to log the attacker in as that user, including administrators. The result is full account takeover and the potential compromise of the entire site.

Vendors product affected is Visa Acceptance Solutions, specifically all plugin releases up to and including version 2.1.0. Sites running WordPress with this plugin under those versions are vulnerable.

The vulnerability has a CVSS score of 9.8, indicating a critical level of risk. EPSS information is not available and the issue is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by sending a crafted request to the guest checkout endpoint, with no prior authentication or privileged access required. Because the flaw results in immediate account takeover, the consequences for confidentiality, integrity, and availability are severe and affect the entire WordPress installation.