{
 "id": "WPSEC-2026-2720",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2720/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2720/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2720/index.md",
 "title": "Visa Acceptance Solutions <= 2.2.2 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via Payer Authentication AJAX Actions",
 "description": "The Visa Acceptance Solutions plugin for WordPress is vulnerable to Insecure Direct Object Reference via the payer authentication AJAX actions (wc_call_uc_payer_auth_setup_action, wc_call_uc_payer_auth_enrollment_action and wc_call_uc_payer_auth_validation_action) in all versions up to, and including, 2.2.2. This is due to the handlers being registered for unauthenticated users and processing a user-supplied order ID without checking that the order belongs to the requester. The handlers also call wp_verify_nonce() but ignore its result. This makes it possible for unauthenticated attackers to run payer authentication enrollment and validation against any order paid through the gateway. A failed or declined transaction then sets that order's status to Failed or Cancelled and adds notes and transaction data to it. The same handlers can also be triggered through forged requests on behalf of a logged-in customer.",
 "plugin": {
  "slug": "visa-acceptance-solutions",
  "name": "Visa Acceptance Solutions",
  "full_name": "Visa Acceptance Solutions",
  "wordpress_org": "https://wordpress.org/plugins/visa-acceptance-solutions/",
  "advisories_url": "https://wpsec.com/vuln/plugin/visa-acceptance-solutions/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/visa-acceptance-solutions"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0.0",
 "remediation": "Update to 3.0.0 or later.",
 "fix_released": "2026-11-06T15:39:27+00:00",
 "published": "2026-11-07T15:42:21+00:00",
 "updated": "2026-11-07T11:06:34.813378+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2720/",
  "https://plugins.svn.wordpress.org/visa-acceptance-solutions/tags/3.0.0/",
  "https://wordpress.org/plugins/visa-acceptance-solutions/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/visa-acceptance-solutions",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}