Vulnerability record · CVE-2026-92996 · published 28 September 2026
CVE-2026-92996: The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a paymen…
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Description
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
Track CVE-2026-92996 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Source: NIST National Vulnerability Database (record CVE-2026-92996), CISA KEV, FIRST EPSS. This page is refreshed as NVD updates the record.
