CVE-2026-8682

Name of the Vulnerable Software and Affected Versions 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On versions prior to 2.0.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify all plugin settings by writing arbitrary data to the ar try on settings option in the database through the '/wp-json/ar try on/v1/settings' REST endpoint.

Recommendations Update to a version newer than 2.0.1.