Executive brief
A WordPress plugin used for displaying 3D models and augmented reality experiences contains a security flaw that allows low-level users to change its settings. An attacker with a basic account, such as a subscriber, could modify the plugin's configuration, potentially disrupting how 3D content is displayed to other visitors. This could impact the website's visual integrity and the functionality of virtual try-on features.
Technical details
The vulnerability is classified as a missing authorization check (CWE-862) within the plugin's REST API implementation. Specifically, the /wp-json/ar_try_on/v1/settings endpoint fails to properly verify if the requesting user has the necessary administrative permissions before processing updates. An authenticated attacker with subscriber-level privileges or higher can send a crafted request to this endpoint to write arbitrary data to the 'ar_try_on_settings' option in the WordPress database. This allows for unauthorized modification of the plugin's global configuration. The issue is present in all versions up to 2.0.1.
Affected products
- WordPress 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On up to, and including, 2.0.1
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3536110%40ar-vr-3d-model-try-on&new=3536110%40ar-vr-3d-model-try-on&sfp_email=&sfph_mail=