Verge3D Publishing And E Commerce
Monthly
Unauthenticated attackers can mark any order in a WordPress site running the Verge3D Publishing and E-Commerce plugin (versions 4.1.0 through 4.13.0) as paid without any payment ever being made. The plugin fails to confirm the transaction with the payment provider and fails to verify that the order belongs to the requesting party, so a fully remote, low-complexity request (CVSS 3.1: AV:N/AC:L/PR:N/UI:N) is enough to flip order status; the resulting impact is integrity-only and limited (C:N/I:L/A:N, score 5.3 MEDIUM), meaning goods or services may be released on unpaid orders rather than data being exposed or the site taken down. Publicly available exploit code exists - the WPScan advisory documents the flaw - and exploitation is confirmed only against sites that actually sell through this plugin's order workflow; no CISA KEV entry indicates confirmed active exploitation.
Unauthenticated attackers can retrieve digital-goods files attached to arbitrary orders through the Verge3D Publishing and E-Commerce WordPress plugin (through version 4.13.0) because its file-download handler performs no access control. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a bounded confidentiality impact, and EPSS is 0.14% (3rd percentile); publicly available exploit code exists, but the vulnerability is not in CISA KEV and SSVC records exploitation as none. The exposure is confined to the digital-goods files themselves - not site credentials, admin functions, or the wider database.
Unauthenticated attackers can mark any order in a WordPress site running the Verge3D Publishing and E-Commerce plugin (versions 4.1.0 through 4.13.0) as paid without any payment ever being made. The plugin fails to confirm the transaction with the payment provider and fails to verify that the order belongs to the requesting party, so a fully remote, low-complexity request (CVSS 3.1: AV:N/AC:L/PR:N/UI:N) is enough to flip order status; the resulting impact is integrity-only and limited (C:N/I:L/A:N, score 5.3 MEDIUM), meaning goods or services may be released on unpaid orders rather than data being exposed or the site taken down. Publicly available exploit code exists - the WPScan advisory documents the flaw - and exploitation is confirmed only against sites that actually sell through this plugin's order workflow; no CISA KEV entry indicates confirmed active exploitation.
Unauthenticated attackers can retrieve digital-goods files attached to arbitrary orders through the Verge3D Publishing and E-Commerce WordPress plugin (through version 4.13.0) because its file-download handler performs no access control. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a bounded confidentiality impact, and EPSS is 0.14% (3rd percentile); publicly available exploit code exists, but the vulnerability is not in CISA KEV and SSVC records exploitation as none. The exposure is confined to the digital-goods files themselves - not site credentials, admin functions, or the wider database.