The Verge3D Publishing and E-Commerce WordPress plugin allows unauthenticated users to download the digital‑goods files linked to any order via its v3d_download_file handler. This exposes users’ purchased products to anyone who can discover or guess an order identifier, resulting in a confidentiality breach of proprietary digital goods and potential economic loss.

WordPress installations running the Verge3D Publishing and E-Commerce plugin version 4.13.0 or earlier are affected. Any site that has not updated the plugin beyond this version is vulnerable.

The flaw requires no credentials; an attacker can request the download endpoint with a valid order ID. The description does not state that order IDs are guessable, but it can be inferred that guessing an order ID could be a viable approach. Because the endpoint is publicly reachable, exploitation can be performed remotely from any network. The CVSS score of 5.3 indicates medium severity, and the EPSS score is <1%, indicating a very low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. The lack of access control presents a risk of unauthorized data disclosure.