Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-92995

Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Verge3D Publishing and E-Commerce

Default version status: unknown

  • 0 to ≤ 4.13.0affected

References