3.8
Faible
CVE-2026-114741 The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…
Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPVR 9.0 | 9.0.0 → < 9.0.3 | 9.0.3 |
Autres CVE de WPVR
Les 4 CVE de WPVR →
CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…
2.7
Faible
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…
4.9
Moyenne
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…
6.8
Moyenne