Impact Analysis

This vulnerability allows authenticated users with relatively low privileges (subscriber-level and above) to modify all settings of the affected plugin.

By writing arbitrary data to the plugin's settings, an attacker could potentially disrupt the plugin's functionality or manipulate its behavior in unintended ways.

Although the CVSS score indicates no impact on confidentiality or availability, the integrity of the plugin's settings can be compromised.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress, affecting all versions up to and including 2.0.1.

It is an authorization bypass issue caused by the plugin not properly verifying whether a user is authorized to perform certain actions.

As a result, authenticated users with subscriber-level access or higher can modify all plugin settings by writing arbitrary data to the ar_try_on_settings option in the database through the /wp-json/ar_try_on/v1/settings REST endpoint.

Useful 0 Not Useful 0