Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92996— Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done

Quick assessment

Affected
Unknown Verge3D Publishing and E-Commerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

从 4.1.0 到 4.13.0 版本的 Verge3D WordPress 插件未向支付服务提供商验证支付是否实际完成，也未检查订单的所有权，导致未经认证的用户可以将任意订单标记为已支付。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92996

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done
Source: CVE Program / CVE List V5
Vulnerability Description
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Verge3D Publishing and E-Commerce 4.1.0 ~ 4.13.0 -

II. Public POCs for CVE-2026-92996

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92996

请登录查看更多情报信息。

Other References for CVE-2026-92996 (1)

Same Patch Batch · Unknown · 2026-09-28 · 8 CVEs total

CVE-2026-84744 6.5 MEDIUM WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Fiel
CVE-2026-88828 5.4 MEDIUM Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-
CVE-2026-89411 5.3 MEDIUM Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent
CVE-2026-86838 5.3 MEDIUM Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
CVE-2026-89300 WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Reci
CVE-2026-89303 Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter

IV. Related Vulnerabilities

Same product: Verge3D Publishing and E-Commerce
Same vendor: Unknown

V. Comments for CVE-2026-92996

No comments yet

Leave a comment