CVE-2025-49268: WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Soft8Soft LLC Verge3D allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Verge3D: from n/a through 4.9.4.
Other sources
Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49268?
CVE-2025-49268 is classified as a high severity vulnerability due to missing authorization in access control settings.
How do I fix CVE-2025-49268?
To fix CVE-2025-49268, ensure that proper access control measures are implemented and configurations are correctly set in Verge3D.
Which versions of Verge3D are affected by CVE-2025-49268?
CVE-2025-49268 affects Verge3D versions from any version up to and including 4.9.4.
What type of vulnerability is CVE-2025-49268?
CVE-2025-49268 is a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Can CVE-2025-49268 impact my WordPress site?
Yes, CVE-2025-49268 can impact WordPress sites that utilize the Verge3D plugin, particularly versions up to 4.9.4.