Visa Acceptance Solutions <= 2.2.2 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via Payer Authentication AJAX Actions
- ID
- WPSEC-2026-2720
- Plugin
- Visa Acceptance Solutions (visa-acceptance-solutions)
- Affected
- all versions before 3.0.0
- Remediation
- Update to 3.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Visa Acceptance Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The Visa Acceptance Solutions plugin for WordPress is vulnerable to Insecure Direct Object Reference via the payer authentication AJAX actions (wc_call_uc_payer_auth_setup_action, wc_call_uc_payer_auth_enrollment_action and wc_call_uc_payer_auth_validation_action) in all versions up to, and including, 2.2.2. This is due to the handlers being registered for unauthenticated users and processing a user-supplied order ID without checking that the order belongs to the requester. The handlers also call wp_verify_nonce() but ignore its result. This makes it possible for unauthenticated attackers to run payer authentication enrollment and validation against any order paid through the gateway. A failed or declined transaction then sets that order's status to Failed or Cancelled and adds notes and transaction data to it. The same handlers can also be triggered through forged requests on behalf of a logged-in customer.
References
- https://wpsec.com/vuln/WPSEC-2026-2720/
- https://plugins.svn.wordpress.org/visa-acceptance-solutions/tags/3.0.0/
- https://wordpress.org/plugins/visa-acceptance-solutions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS