CVE-2026-114740
UnknownSummary
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard. This allows users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Risk Assessment
Low-privileged users can publish content and set metadata, potentially leading to unauthorized changes and possible injection of malicious data.
Recommendation
Update the plugin to version 9.1.3 or later. Consider limiting Contributor privileges to the minimum necessary.
Other vulnerabilities in WPVR WordPress plugin
See all- CVE-2026-114742Unknown
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
- CVE-2026-114741Unknown
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users.
Original NVD description (English source)
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS