CVE-2026-92996 Verge3D CVE debrief

Who should care

Defenders responsible for WordPress installations using the Verge3D plugin, particularly those with order management systems that may be impacted by this vulnerability, should assess their exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-92996 is a medium-severity vulnerability in the Verge3D WordPress plugin that allows unauthenticated users to mark orders as paid. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assessing the potential impact on their order management systems. The vulnerability requires verification from official sources, and its scope and remediation are currently limited by the available information.

• Potential unauthorized marking of orders as paid, requiring verification of order status and potential reconciliation of order discrepancies.
• Possible impact on order management systems, requiring review and monitoring of order processing and payment verification.

Technical summary

The Verge3D WordPress plugin, versions 4.1.0 through 4.13.0, does not verify with the payment provider that a payment was actually made and does not check order ownership. This allows unauthenticated users to mark any order as paid. The vulnerability requires verification from official sources, and its scope and remediation are currently limited by the available information. The lack of verification and order ownership checks can lead to potential unauthorized marking of orders as paid, requiring verification of order status and potential reconciliation of order

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assessing the potential impact on their order management systems.

Recommended defensive actions

• Verify the version of the Verge3D WordPress plugin and update to a fixed version if necessary.
• Review order management systems for potential exposure to this vulnerability.
• Implement additional monitoring to detect potential abuse of this vulnerability.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.