CVE-2026-92995 in Verge3D Publishing and E-Commerce Plugin
Summary
by MITRE • 09/27/2026
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in the Verge3D Publishing and E-Commerce WordPress plugin versions up to 4.13.0 represents a critical failure in access control mechanisms within the application's file handling subsystem. This flaw specifically affects the digital-goods delivery functionality, which is designed to provide customers with secure downloads of purchased items following successful transactions. The core technical issue stems from an improper restriction on the endpoint responsible for serving these files. Instead of validating that the requesting user possesses a valid session token or has completed the necessary authentication and authorization steps associated with a specific order, the handler accepts requests directly without verifying ownership. This architectural oversight allows any individual interacting with the web server to trigger the download process by simply providing the correct file identifier in the request parameters.
From an operational perspective, this lack of enforcement means that unauthenticated actors can bypass payment gates and access restrictions entirely. By manipulating URL parameters or crafting direct HTTP requests to the vulnerable endpoint, attackers can retrieve digital goods such as 3D models, textures, scripts, or other proprietary assets intended only for paying customers. This constitutes a severe breach of confidentiality and integrity regarding business logic, effectively enabling theft of intellectual property and revenue loss for merchants relying on this plugin for e-commerce operations. The impact extends beyond immediate financial damage to include potential reput harm if sensitive internal documentation or unreleased products are exposed publicly.
This vulnerability aligns with CWE-284 Improper Access Control, as the application fails to enforce proper authorization checks before granting access to restricted resources. Furthermore, it maps directly to MITRE ATT&CK technique T1530 Data from Cloud Storage Object Exfiltration or more broadly T1078 Valid Accounts if combined with credential stuffing, though in this specific instance, no valid account is required due to the complete absence of authentication checks for certain file retrieval paths. The exploitation vector falls under CWE-20 Improper Input Validation because the system does not adequately verify that the requester has legitimate rights to view or download the specified resource based on their current session state or order history.
Mitigation strategies must prioritize immediate patching to version 4.13.1 or later where this access control logic has been corrected. Administrators should ensure that all instances of the plugin are updated promptly to close these unauthorized entry points. In environments where updating is not immediately feasible, temporary compensating controls can be implemented at the web server level by restricting direct access to the specific file-handling endpoints using IP whitelisting or requiring valid session cookies for those paths via configuration directives in Nginx or Apache. Additionally, implementing a Web Application Firewall with rules targeting common parameter tampering patterns related to digital download handlers may provide an additional layer of defense against automated exploitation attempts while permanent fixes are deployed.