CVE-2026-92995 Verge3D CVE debrief

Who should care

Defenders and administrators of WordPress sites using the Verge3D Publishing and E-Commerce plugin should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-92995 allows unauthenticated users to download digital-goods files without authorization, potentially leading to data leakage or exposure. Defenders and administrators of WordPress sites using the Verge3D Publishing and E-Commerce plugin should assess exposure and prioritize verification and remediation.

• Potential unauthorized access to sensitive digital goods
• Possible data leakage or exposure of sensitive information
• Need for verification of plugin version and configuration
• Potential impact on e-commerce operations and customer data

Technical summary

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download digital-goods files attached to any order without authorization. This issue arises from the plugin's failure to implement proper access controls on the file-download handler, potentially exposing sensitive digital goods to unauthorized access. Affected product deployments should be identified, and defenders should prioritize verifying and restricting access to the file-download handler.

Defensive priority

Defenders should prioritize verifying and restricting access to the file-download handler in the Verge3D Publishing and E-Commerce WordPress plugin.

Recommended defensive actions

• Verify and restrict access to the file-download handler in the Verge3D Publishing and E-Commerce WordPress plugin
• Review and update the plugin to version above 4.13.0 if available
• Monitor for unauthorized access to digital-goods files

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional verification is needed to confirm affected versions and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.