CVE-2026-8682

The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin settings by writing arbitrary data to the ar_try_on_settings option in the database via the /wp-json/ar_try_on/v1/settings REST endpoint.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L102
• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L358
• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/1.9.0/api/AR_TRY_ON_Api_Routes.php#L40
• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L102
• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L358
• https://plugins.trac.wordpress.org/browser/ar-vr-3d-model-try-on/tags/2.0.1/api/AR_TRY_ON_Api_Routes.php#L40
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3536110%40ar-vr-3d-model-try-on&new=3536110%40ar-vr-3d-model-try-on&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcd914c-3c12-4e6a-bb05-38d42ce411d4?source=cve

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86812The WPCafe WordPress plugin before 3.0.18 does not correctl…6.5
• CVE-2026-86813The MetForm WordPress plugin before 4.1.9 does not properly …4.8
• CVE-2026-86814The UsersWP WordPress plugin before 1.5.10 does not verify …8.1
• CVE-2026-86815The BackWPup WordPress plugin before 5.7.5 does not properl…5.5
• CVE-2026-86818fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
• CVE-2026-86819Waves Central for macOS contains a local privilege escalatio…7.1
• CVE-2026-86823The Newsletter WordPress plugin before 9.3.7 does not valid…5.3
• CVE-2026-86824The Newsletter WordPress plugin before 9.3.8 does not gener…4.8
• CVE-2026-8683Mattermost Desktop App versions <=6.1 5.5.13.0 fail to accou…6.5
• CVE-2026-86830Incorrect privilege assignment in Temporary Elevated Access …7.2
• CVE-2026-86831Improper validation of pod identifier uniqueness in aws-netw…8.7
• CVE-2026-86836In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent c…8.4