What is the CVSS score of CVE-2025-49268?

CVE-2025-49268 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Verge3D are affected by CVE-2025-49268?

Organizations using Missing Authorization vulnerability in Soft8Soft LLC Verge3D should be aware of moderate risk from CVE-2025-49268, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2025-49268?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Verge3D CVE-2025-49268

EUVD-2025-17283 MEDIUM

Missing Authorization (CWE-862)

2025-06-06 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

AV:N, AC:L, PR:N, UI:N per description; low confidentiality impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17283

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Soft8Soft LLC Verge3D allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Verge3D: from n/a through 4.9.4.

AnalysisAI

Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) in the Verge3D plugin for WordPress. The plugin likely provides 3D web publishing features, and the flaw allows attackers to bypass access control checks, potentially viewing restricted content. The CVSS vector indicates network-based, low-complexity, unauthenticated exploitation with no privileges required and no user interaction.

RemediationAI

Upgrade Verge3D to version 4.9.5 or later, as per vendor advisory. No workarounds are documented; ensure access control settings are correctly configured. Monitor Patchstack for updates.