rootpwn

medium · CVSS v3 5.3 · EPSS 0.00114

CVE-2026-92996

The Verge3D WordPress plugin (v4.1.0–4.13.0) allows unauthenticated users to mark any order as paid without verification. This flaw can lead

Overview

The Verge3D WordPress plugin (v4.1.0–4.13.0) allows unauthenticated users to mark any order as paid without verification. This flaw can lead to fraudulent orders and revenue loss. The issue is due to missing payment verification and order ownership checks.

Description

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.

Impact

Confidentiality is minimally affected, but integrity is compromised as order status can be altered by attackers. Availability remains unaffected. Site owners, e-commerce managers, and payment processors are directly impacted by potential revenue loss and unauthorized content access.

Remediation

Upgrade to the latest Verge3D plugin version (≥4.14.0) where payment verification and order ownership checks are implemented. If an upgrade is not possible, disable the payment processing endpoint or restrict access to the order status endpoint to authenticated administrators only. Monitor order logs for suspicious status changes and audit payment workflows regularly.

Risk context

The vulnerability has a medium severity rating and a very low EPSS score (0.00114), indicating limited exploitation likelihood, but the potential impact on revenue warrants timely patching.

Affected products

  • Verge3D WordPress plugin

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
0.00114

WordPress plugin payment order unauthenticated integrity verge3d

← All CVEs

Related CVEs

medium

CVE-2026-100890

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-100899

A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-100907

A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-82546

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.

View analysis