Missing Authorization Issue in Soft8Soft LLC Verge3D
CVE-2025-49268

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Verge3d
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49268?

The Verge3D product by Soft8Soft LLC is impacted by a missing authorization vulnerability which can lead to incorrect access control configurations. This flaw allows attackers to potentially exploit vulnerabilities in how access levels are enforced within the application, making unauthorized actions possible. Versions affected range from n/a to 4.9.4. Appropriate measures must be taken to secure the system against unauthorised access.

Affected Version(s)

Verge3D <= 4.9.4

References

https://patchstack.com/database/wordpress/plugin/verge3d/...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.