CVE-2026-114742
UnknownSummary
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Risk Assessment
Low-privileged users can modify and publish other users' content, potentially leading to unauthorized changes and data integrity violations.
Recommendation
Update the plugin to version 9.0.3 or later. Consider limiting Contributor privileges to the minimum necessary.
Other vulnerabilities in WPVR WordPress plugin
See all- CVE-2026-114741Unknown
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users.
- CVE-2026-114740Unknown
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard. This allows users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Original NVD description (English source)
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS