CVE-2026-8682 describes an authorization bypass vulnerability (CWE-862) in the 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin by hasanazizul. The plugin fails to verify that a user is authorized to perform certain actions via the /wp-json/ar_try_on/v1/settings REST endpoint. As a result, authenticated users with subscriber-level privileges or higher can write arbitrary data to the plugin's settings stored in the database (ar_try_on_settings option). This vulnerability affects all versions up to and including 2.0.1. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation has been published by the vendor as of the publication date.

An attacker with authenticated subscriber-level access or higher can bypass authorization controls to modify all plugin settings by writing arbitrary data to the plugin's database option. This could lead to unauthorized changes in the plugin's behavior or configuration, potentially affecting site functionality or security. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unusual changes to the ar_try_on_settings option. Avoid granting unnecessary privileges to users. Follow vendor channels for updates on patches or official mitigations.