# Visa Acceptance Solutions <= 2.2.2 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via Payer Authentication AJAX Actions

- **ID:** WPSEC-2026-2720
- **Plugin:** Visa Acceptance Solutions (`visa-acceptance-solutions`), https://wordpress.org/plugins/visa-acceptance-solutions/
- **Affected versions:** all versions before 3.0.0
- **Fixed in:** 3.0.0 (Update to 3.0.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/visa-acceptance-solutions
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2720/

## Description

The Visa Acceptance Solutions plugin for WordPress is vulnerable to Insecure Direct Object Reference via the payer authentication AJAX actions (wc_call_uc_payer_auth_setup_action, wc_call_uc_payer_auth_enrollment_action and wc_call_uc_payer_auth_validation_action) in all versions up to, and including, 2.2.2. This is due to the handlers being registered for unauthenticated users and processing a user-supplied order ID without checking that the order belongs to the requester. The handlers also call wp_verify_nonce() but ignore its result. This makes it possible for unauthenticated attackers to run payer authentication enrollment and validation against any order paid through the gateway. A failed or declined transaction then sets that order's status to Failed or Cancelled and adds notes and transaction data to it. The same handlers can also be triggered through forged requests on behalf of a logged-in customer.

## References

- https://wpsec.com/vuln/WPSEC-2026-2720/
- https://plugins.svn.wordpress.org/visa-acceptance-solutions/tags/3.0.0/
- https://wordpress.org/plugins/visa-acceptance-solutions/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2720/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.