WPVR WordPress plugin vulnerabilities

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users.

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard. This allows users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.