medium5.3
CVE-2026-92995
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to do…
Impact
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
Affected products
| Product | Affected versions |
|---|---|
| Verge3D Publishing And E-Commerce WordPress Plugin | through 4.13.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.