EUVD-2026-88102
GHSA-h272-7wqm-px5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public store endpoint unauthenticated
-
DeliveryPlace or target arbitrary order
-
ExploitSend forged payment-confirmation request
-
ExecutionOrder marked paid without provider verification
-
ImpactFraudulent fulfillment / financial loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Requires only a reachable Verge3D-powered WordPress store running the plugin version 4.1.0 through 4.13.0 with its publishing/e-commerce (order/payment) feature in use; no authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N/AC:L). The practical limiting factors are that the target must actually be selling via this plugin's order workflow and the attacker gains only the ability to mark orders as paid (integrity), not to read data or take the site down. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 MEDIUM) indicates a fully remote, unauthenticated, low-complexity attack with no user interaction and a low integrity-only impact - consistent with the description of an unauthenticated actor marking any order as paid. Public exploit code exists (WPScan advisory), but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data, so this is 'publicly available exploit code exists' rather than confirmed in-the-wild abuse. The medium CVSS understates the practical impact: the flaw is an e-commerce payment-verification bypass (the plugin never confirms payment with the provider and never checks order ownership), meaning an attacker can obtain goods/services without paying - real integrity/financial fraud even though confidentiality and availability are untouched. Net assessment: a genuine but narrowly-scoped fraud risk on affected stores; priority is limited chiefly by the plugin's niche footprint rather than by exploit difficulty. Note the CVSS I:L may understate business impact for high-value order fulfillment. |
| Exploit ScenarioDerived | An unauthenticated attacker places an order in a Verge3D-powered WooCommerce/WordPress store, then sends a crafted request to the plugin's payment-confirmation endpoint to flip the order status to 'paid' without any real transaction and without owning the order. Because the plugin neither validates the payment with the provider nor checks order ownership, the store treats the order as legitimately paid and fulfills it. Public exploit details are available via the WPScan advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated attackers can mark any order in a WordPress site running the Verge3D Publishing and E-Commerce plugin (versions 4.1.0 through 4.13.0) as paid without any payment ever being made. The plugin fails to confirm the transaction with the payment provider and fails to verify that the order belongs to the requesting party, so a fully remote, low-complexity request (CVSS 3.1: AV:N/AC:L/PR:N/UI:N) is enough to flip order status; the resulting impact is integrity-only and limited (C:N/I:L/A:N, score 5.3 MEDIUM), meaning goods or services may be released on unpaid orders rather than data being exposed or the site taken down. Publicly available exploit code exists - the WPScan advisory documents the flaw - and exploitation is confirmed only against sites that actually sell through this plugin's order workflow; no CISA KEV entry indicates confirmed active exploitation.
RemediationAI
No vendor-released patch or fixed version is referenced in the available intelligence, so until an update is published the primary control is to stop relying on the plugin's payment state: deactivate Verge3D Publishing and E-Commerce (or, if the storefront must stay up, disable the order/payment feature and switch checkout to a payment flow whose status is set only by the provider's signed callback). Complement that by restricting access to the plugin's order-status endpoints - block or challenge the relevant admin-ajax/REST routes at the WAF or reverse proxy for untrusted clients, accepting that this can break legitimate front-end order updates if the plugin posts from the browser. Independently reconcile order status against the payment provider's transaction records on a schedule and alert on orders flipped to paid without a matching settlement, which detects abuse but does not prevent it. Where the plugin must remain fully active, treat any goods or services released on the strength of the in-plugin paid flag as untrusted and require manual verification before fulfilment, at the cost of additional operational overhead and slower order turnaround. Monitor the WPScan advisory at https://wpscan.com/vulnerability/c97c7466-ea48-47d0-b562-c26127be3bcc/ for a fixed version, noting that publicly available exploit code already exists, so pre-patch exposure should be treated as business risk rather than theoretical.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Verge3D Publishing and E-Commerce is a WordPress plugin that adds 3D-configurator storefronts and an order/payment workflow to a WordPress site. The defect is a server-side trust failure in that workflow: the plugin accepts an order-status update to "paid" without querying the payment provider to confirm a settlement actually occurred, and without an ownership/authorization check binding the order to the requester. In class terms this lines up with missing authorization on an order object plus insufficient verification of an external payment assertion (the feed supplies no CWE assignment; CWE-862 Missing Authorization and CWE-345 Insufficient Verification of Authenticity are the closest fits). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms the endpoint is reachable over the network and needs no credentials, no victim interaction with the attacker's request, and no non-default configuration - the practical gate is simply that the target must be using the plugin's order/payment feature. Because only the order's paid flag is influenced, the assessment keeps scope unchanged and impact at low integrity, with no confidentiality or availability effect.
Know when Verge3D Publishing And E Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated with no interaction (AV:N/AC:L/PR:N/UI:N); integrity-only impact from falsifying paid status (I:L), no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB