Security Alert Summary
The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress contains an authorization bypass vulnerability that affects all versions up to and including 2.0.1. Authenticated users with subscriber-level access and above can modify plugin settings by sending data to the plugin REST endpoint, allowing arbitrary values to be written to the plugin’s ar_try_on_settings option.
CVE Details
- CVE ID: CVE-2026-8682
- Affected component: 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress
- Affected versions: All versions up to and including 2.0.1
- Published: May 28, 2026 at 8:16 AM UTC
- Last modified: May 28, 2026 at 1:45 PM UTC
- CVSS v3.1: Base Score 4.3, MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: Requires authentication; privileges required: LOW (authenticated user such as subscriber); user interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
According to the advisory, the plugin does not properly verify that a user is authorized to perform certain actions. The REST endpoint /wp-json/ar_try_on/v1/settings can be used by authenticated users with subscriber-level access and above to write arbitrary data into the ar_try_on_settings option in the WordPress database. Because the plugin fails to enforce proper authorization checks before accepting and storing submitted settings, these authenticated users can modify plugin configuration values they should not be allowed to change.
The impact is limited to modification of plugin settings (integrity impact). There is no CVSS indication of direct confidentiality or availability impact. The issue exists because the plugin accepts and persists input via its REST interface without verifying that the requesting user has the proper authorization to perform that operation.
How This Could Impact Your Website
In a multi-user WordPress environment — for example, a site owner, internal staff members, and external contractors or contributors — this vulnerability means a low-privilege authenticated account could change plugin settings. Practical consequences include altered site behavior or UI elements controlled by the plugin, unexpected configuration changes, or loss of intended functionality for site users.
Because attackers with subscriber-level access can change plugin settings, they might use those changes to insert misleading content or links that could aid in targeted phishing or social engineering against staff or customers. While the CVSS data indicates confidentiality impact is none, changed settings could indirectly increase social engineering risk or reduce trust in site content.
professional review may help if you are unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts that no longer need site access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and plugin settings for unusual changes or unexpected configuration updates.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L102
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L358
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L40
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L102
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L358
- https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L40
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3536110%40ar-vr-3d-model-try-on&new=3536110%40ar-vr-3d-model-try-on&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcd914c-3c12-4e6a-bb05-38d42ce411d4?source=cve
