medium5.3
CVE-2026-92996
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order own…
Impact
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Affected products
| Product | Affected versions |
|---|---|
| Verge3D WordPress Plugin From 4.1.0 | through 4.13.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.