The vulnerability allows an authenticated user with subscriber level access or higher to modify the plugin settings without proper authorization checks. This is a classic missing authorization weakness (CWE-862) that enables arbitrary changes to the ar_try_on_settings option in the database via the /wp-json/ar_try_on/v1/settings REST endpoint. Such changes can potentially alter the behavior of the 3D Viewer plugin in ways that may be undesirable or harmful, including misconfiguration that could expose additional capabilities to the attacker or other users.

WordPress 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin, all releases up to and including 2.0.1. Any installation of these affected versions is susceptible to the flaw.

The CVSS score of 4.3 indicates a moderate severity. The exploit requires only authentication as a subscriber or better and sending a crafted request to a documented REST endpoint; no elevated privileges or network restrictions are needed. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation is moderate but depends on the presence of an authenticated compromised account.