3.8
Low
CVE-2026-114741 The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…
Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPVR 9.0 | 9.0.0 → < 9.0.3 | 9.0.3 |
Other CVEs of WPVR
The 4 CVEs of WPVR →
CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…
2.7
Low
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…
4.9
Medium
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…
6.8
Medium