CVE-2026-114741
Received Received - Intake

WPVR Plugin Object-Level Authorization Bypass

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-114741
EUVD
EUVD-2026-109348

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WPVR 9.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the WP VR WordPress plugin versions 9.0.0 to 9.0.2. It allows users with contributor-level access or higher to read and modify virtual tours created by other users without proper authorization checks.

Detection Guidance

Check the installed version of the WPVR WordPress plugin. If it is between 9.0.0 and 9.0.2, the system is vulnerable. Use WordPress admin dashboard or run: wp plugin list --name=wpvr to verify the version.

Impact Analysis

An attacker with contributor-level access could view or alter virtual tours they do not own, potentially leading to unauthorized data exposure or manipulation of content. This could affect the integrity and confidentiality of the virtual tours on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data within virtual tours, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data is involved. Compliance may be compromised due to unauthorized data exposure or modification.

Mitigation Strategies

Update the WPVR plugin to version 9.0.3 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review user roles and permissions to ensure contributors and above do not have unnecessary access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart