Live › vulnerability › CVE-2026-114740
Go to dashboardThe WPVR WordPress plugin before 9.1.3 fails to check user capabilities when creating a tour through its setup wizard. A logged-in user with the Contributor role or higher can create and publish tour content and set arbitrary post metadata they could not normally publish.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the WPVR plugin before 9.1.3 that allow Contributor-level or higher accounts to log in. Sites without the plugin, or with it at 9.1.3 or later, are not affected. Sites where only administrators and editors have accounts face lower risk.
No product ranges from the sources yet.
wp plugin get wpvr --field=version9.1.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
This page as .md · .json · in your agent: get_signal("CVE-2026-114740")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.