CVE-2026-114740
Received Received - Intake

WPVR Plugin Unauthorized Tour Creation via Contributor Role

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-114740
EUVD
EUVD-2026-109347

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WPVR 8.5.55

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the WPVR WordPress plugin before version 9.1.3 allows users with the Contributor role or higher to create and publish tour content through the setup wizard. It also lets them set arbitrary post metadata that they normally couldn't modify due to incorrect user capability checks in the plugin.

Detection Guidance

Check the installed version of the WP VR plugin. If it is between 8.5.55 and 9.1.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker with Contributor access or higher could publish unauthorized tour content or manipulate post metadata, potentially leading to misinformation, defacement, or unauthorized data exposure on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized content publication or metadata changes, potentially violating data integrity and access control requirements in GDPR and HIPAA. Unauthorized modifications may result in non-compliance with these regulations.

Mitigation Strategies

Update the WP VR plugin to version 9.1.3 or later immediately. Review user roles with 'Contributor' or higher for unauthorized tour content creation. Remove any suspicious metadata set by unauthorized users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart