Junglewise Threat Intelligence

CVE-2026-8682: WordPress 3D Viewer plugin authorization bypass in REST API

CVE-2026-8682 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Vendors: bPlugins, Wordpress.

Executive brief

A WordPress plugin used for displaying 3D models and augmented reality experiences contains a security flaw that allows low-level users to change its settings. An attacker with a basic account, such as a subscriber, could modify the plugin's configuration, potentially disrupting how 3D content is displayed to other visitors. This could impact the website's visual integrity and the functionality of virtual try-on features.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the plugin's REST API implementation. Specifically, the /wp-json/ar_try_on/v1/settings endpoint fails to properly verify if the requesting user has the necessary administrative permissions before processing updates. An authenticated attacker with subscriber-level privileges or higher can send a crafted request to this endpoint to write arbitrary data to the 'ar_try_on_settings' option in the WordPress database. This allows for unauthorized modification of the plugin's global configuration. The issue is present in all versions up to 2.0.1.

Affected products

  • WordPress 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On up to, and including, 2.0.1

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References