2.7
Faible
CVE-2026-114742 The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…
Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPVR 8.3 | 8.3.0 → < 9.0.3 | 9.0.3 |
Autres CVE de WPVR
Les 4 CVE de WPVR →
CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…
3.8
Faible
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…
4.9
Moyenne
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…
6.8
Moyenne