Verge3D E-Commerce CVE-2026-92995

No special conditions - remote unauthenticated exploitation against default configurations of the Verge3D Publishing and E-Commerce WordPress plugin (version ≤4.13.0). The only prerequisites are that the plugin is installed/active and that orders with attached digital-goods files exist to be retrieved. The download handler enforces no access control, so no authentication, user interaction, or non-default setting is required; the practical limiting factor is that the attacker must reference valid order/file identifiers (enumerable or guessable) and that exposure is confined to the digital-goods files themselves - not site credentials, admin functions, or the wider database.

This is a genuine but bounded confidentiality issue, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated missing-authorization flaw in a file-download handler, with only low confidentiality impact and no integrity or availability effect. All signals point the same direction - no contradiction between the vector and the description. Real-world urgency is tempered by the other sources: EPSS is 0.14% (3rd percentile), the vulnerability is NOT in CISA KEV, and SSVC records Exploitation: none. However, SSVC Automatable: yes and Technical Impact: partial, combined with publicly available WPScan exploit code, mean opportunistic scraping of order files is plausible even without evidence of active campaigns. Net: a real, easily-triggered data-exposure bug worth patching, but the low EPSS, absence of KEV, and 'none' exploitation status indicate it is not currently seeing widespread exploitation. The C:L rating is appropriate - exposure is limited to digital-goods files rather than credentials or full database access.

An unauthenticated attacker enumerates or guesses order identifiers and requests them through the plugin's unprotected file-download handler, retrieving the digital-goods files (e.g., paid downloads, licensed assets) attached to arbitrary orders without purchasing them or logging in. Public exploit code exists (WPScan), lowering the effort required. Because no authentication or user interaction is needed and the request is a simple HTTP GET, the attack is trivially scriptable and automatable.