What is the CVSS score of CVE-2026-40729?

CVE-2026-40729 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

3D Viewer CVE-2026-40729

Q: Which versions of 3D Viewer are affected by CVE-2026-40729?

Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content.

EUVD-2026-22885 MEDIUM

Missing Authorization (CWE-862)

2026-04-15 Patchstack

GHSA-8f3x-4qgm-mmjv

WordPress Authentication Bypass 3D Viewer Embed 3D Models Wordpress Plugin Bplugins

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires authenticated low-privilege user, low integrity impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:38 vuln.today

CVSS changed

Apr 16, 2026 - 15:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22885

CVE Published

Apr 15, 2026 - 10:21 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in bPlugins 3D viewer - Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer - Embed 3D Models: from n/a through <= 1.8.5.

AnalysisAI

Missing authorization in the bPlugins 3D viewer WordPress plugin allows authenticated users with low privileges to bypass access controls and modify content. Affected versions up to and including 1.8.5. No public exploitation has been identified, EPSS score is very low (0.02%), and SSVC indicates no exploitation, so real-world risk is minimal.

Technical ContextAI

This is a WordPress plugin for embedding 3D models, written in PHP. The vulnerability is a Missing Authorization (CWE-862) flaw, where the plugin fails to properly verify that a user has sufficient privileges before allowing access to certain administrative functions. CPE data shows all versions through 1.8.5 are affected. The root cause is an incorrectly configured access control check, typical of many WordPress plugin vulnerabilities.

RemediationAI

No vendor-released patch has been identified at the time of analysis. As a workaround, restrict access to the plugin's functionality by configuring user roles and capabilities appropriately, and consider disabling the plugin if it is not actively required. Monitor for updates from bPlugins and apply any security patches as soon as they become available.