CVE-2026-8682: 3D Viewer WordPress Plugin Authorization Bypass – Patch & Detection

Technical summary

CVE-2026-8682 is an authorization bypass vulnerability in the 3D Viewer plugin for WordPress affecting all versions through 2.0.1. The vulnerability stems from insufficient authorization verification on the /wp-json/ar_try_on/v1/settings REST endpoint. Authenticated users with subscriber-level privileges or higher can exploit this to write arbitrary data to the ar_try_on_settings option without proper capability checks, violating the principle of least privilege and allowing unauthorized modification of plugin configuration.

Business impact

An attacker with minimal WordPress access can reconfigure the 3D viewer plugin's behavior without administrator approval. This could enable defacement of virtual try-on experiences, injection of malicious content, redirection of users, or disruption of e-commerce workflows that rely on the 3D visualization features. For retailers or sites monetizing augmented reality features, unauthorized settings changes could compromise user trust and transaction integrity.

Affected systems

WordPress installations using the 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin in versions 2.0.1 and earlier are affected. Any WordPress site with this plugin active and users assigned subscriber role or above are at risk if the REST endpoint is accessible (typically enabled by default in modern WordPress).

Exploitability

The vulnerability requires network access and prior authentication to a WordPress account with at least subscriber-level permissions. No special conditions, user interaction, or elevated privileges are needed beyond that baseline. The attack surface is the public REST API endpoint, making it accessible to any authenticated user. Given the low barrier to entry and straightforward exploitation, this represents a practical risk in environments where subscriber accounts are freely distributed or shared.

Remediation

Update the 3D Viewer plugin to a version that implements proper authorization checks on the REST endpoint. Verify the vendor advisory for the patched version number. Until patched, restrict REST API access to trusted users, disable the plugin if unused, or apply Web Application Firewall rules to block requests to /wp-json/ar_try_on/v1/settings from low-privileged accounts.

Patch guidance

Check the official WordPress plugin repository or the vendor's security advisory for version 2.0.2 or later. Verify that the patched version explicitly validates user capabilities before allowing writes to ar_try_on_settings. Test the update in a staging environment to confirm that legitimate administrative workflows continue to function and that subscriber-level users can no longer modify plugin settings.

Detection guidance

Monitor WordPress REST API access logs for POST or PUT requests to /wp-json/ar_try_on/v1/settings endpoints, especially from accounts with subscriber role. Track database changes to the ar_try_on_settings option and correlate with user activity logs. Audit plugin settings and ar_try_on configuration for unexpected values or suspicious modifications. Use WordPress security plugins to log REST API activity and flag unauthorized option updates.

Why prioritize this

This vulnerability scores MEDIUM (4.3 CVSS) due to low attack complexity, network accessibility, and the fact that it requires prior authentication. However, prioritization should account for the prevalence of subscriber-level access in WordPress environments and the potential for configuration tampering. Sites with publicly available subscriptions or shared accounts face higher practical risk. Organizations relying on the 3D/AR features for commerce should prioritize patching to maintain feature integrity and user confidence.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: network-based attack vector, low attack complexity, requirement for low-level authentication, no confidentiality impact, low integrity impact (configuration modification only), and no availability impact. The score appropriately captures the authorization bypass nature and the limited scope of damage per instance. However, cumulative risk may be higher in multi-tenant or high-traffic environments where settings changes cascade to many users.

Frequently asked questions