CVE-2026-114742
Received Received - Intake

WPVR Plugin Object Ownership Validation Bypass

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-114742
EUVD
EUVD-2026-109349

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WPVR 8.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the WP VR WordPress plugin. It allows users with contributor-level access or higher to modify, reconfigure, and publish virtual tours created by other users without proper ownership checks.

Detection Guidance

Check the installed version of the WP VR plugin. If it is between 8.3.0 and 9.0.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker with contributor access could alter or publish virtual tours they do not own, potentially leading to unauthorized content changes or data exposure. This could disrupt website functionality or misrepresent information.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive content, potentially violating integrity and access control requirements in GDPR or HIPAA. Compliance may be impacted if user data or content is improperly altered.

Mitigation Strategies

Update the WP VR plugin to version 9.0.3 or later immediately. Remove or restrict contributor-level access if not required. Monitor for unauthorized changes to virtual tours.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart