CVE-2026-8682

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin settings by writing arbitrary data to the ar_try_on_settings option in the database via the /wp-json/ar_try_on/v1/settings REST endpoint.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-868235.3The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription actionCVE-2026-868244.8The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its trackinCVE-2026-868265.9The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, aCVE-2026-868275.3The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originateCVE-2026-868286.6The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when CVE-2026-86836.5Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App whicCVE-2026-868307.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 mighCVE-2026-868318.7Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow anCVE-2026-868325.3The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to CVE-2026-868335.4The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body oCVE-2026-868343.7The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submissCVE-2026-868368.4In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta
CVE-2026-8682: Medium severity, CVSS 4.3 | Vulnix