The Verge3D WordPress plugin, between versions 4.1.0 and 4.13.0, omits a crucial verification step with its payment gateway and does not confirm that an order belongs to the user initiating the request, allowing an unauthenticated request to the v3d_payment_done endpoint to mark any order as paid. This flaw is a form of authorization bypass that corresponds to CWE-345, enabling attackers to receive paid content or services without completing legitimate payment and thereby compromising the monetary integrity of the site.

The affected system is the Verge3D WordPress plugin, used by Verge3D Publishing and E-Commerce. All installations of the plugin from release 4.1.0 through 4.13.0 are vulnerable, regardless of host WordPress configuration. No specific CPE string is provided, but the scope includes all sites running these plugin versions.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Based on the description, the likely attack vector is web‑based, as the payment confirmation endpoint can be reached without authentication. An attacker with shallow technical skills could craft a request to the vulnerable endpoint, bypass payment verification, and gain access to paid content or services.