CVE-2023-51420 CRITICAL

CVE-2023-51420: WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)

Vendor Soft8Soft Llc
Product Verge3D Publishing and E-Commerce
Weakness CWE-94 · Code injection
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

Explanation of Vulnerability in Simple Terms

02Summary

Verge3D Publishing and E-Commerce versions up to 4.5.2 contain a code injection vulnerability that allows high-privileged users to run arbitrary code on the server. The vulnerability exists due to insufficient input validation in a code execution pathway. An attacker with administrative or equivalent access can inject malicious code that executes with full server privileges, potentially compromising the entire application and underlying system.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the server with full application privileges.

Potential impact on your site

04Site Impact

A compromised admin account can execute arbitrary code, leading to complete site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative access to the Verge3D application.

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-14541 Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter CVE-2026-27044 WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability CVE-2026-3309 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields CVE-2026-2830 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' CVE-2026-2052 Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic