{"id":"CVE-2026-114740","kind":"vulnerability","aliases":["CVE-2026-114740"],"related":[],"title":"WPVR WordPress plugin: contributors can publish tours and set arbitrary post metadata","description":"The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.","summary":"The WPVR WordPress plugin before 9.1.3 fails to check user capabilities when creating a tour through its setup wizard. A logged-in user with the Contributor role or higher can create and publish tour content and set arbitrary post metadata they could not normally publish.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvr"],"not_affected_if":["no-contributor-accounts","plugin-at-9.1.3-or-later"],"how_to_check":"- Check the installed WPVR version in the WordPress admin plugin list or with `wp plugin get wpvr --field=version`\n- Review recently created or published tour posts and post metadata for entries from Contributor-level accounts","fix":"- Update the WPVR plugin to `9.1.3` or later\n- Review Contributor and higher accounts if the plugin was on an earlier version","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:39+00:00","updated_at":"2026-10-25T06:37:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T06:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WPVR plugin to `9.1.3` or later\n- Review Contributor and higher accounts if the plugin was on an earlier version","reach":"internet","title":"WPVR WordPress plugin: contributors can publish tours and set arbitrary post metadata","impact":"medium","summary":"The WPVR WordPress plugin before 9.1.3 fails to check user capabilities when creating a tour through its setup wizard. A logged-in user with the Contributor role or higher can create and publish tour content and set arbitrary post metadata they could not normally publish.","category":"package","nicknames":[],"who_cares":["wordpress","wpvr","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Contributor-level users publish arbitrary tour content and set arbitrary post metadata","analyst_note":"","how_to_check":"- Check the installed WPVR version in the WordPress admin plugin list or with `wp plugin get wpvr --field=version`\n- Review recently created or published tour posts and post metadata for entries from Contributor-level accounts","needs_analyst":false,"not_affected_if":["plugin-at-9.1.3-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the WPVR plugin before 9.1.3 that allow Contributor-level or higher accounts to log in. Sites without the plugin, or with it at 9.1.3 or later, are not affected. Sites where only administrators and editors have accounts face lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3302,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114740':15A,18A '-2026':14A,17A '9.1.3':30B,76C 'allow':91C 'arbitrari':10A,63B,107C 'capabl':35B,82C 'check':33B,80C 'content':60B,104C 'contributor':4A,51B,95C 'correct':79C 'could':67B,111C 'creat':37B,56B,84C,100C,114C 'cve':13A,16A 'fail':31B 'higher':54B 'host':22B 'log':46B 'logged-in':45B 'metadata':12A,65B,109C 'normal':69B 'otherwis':113C 'packag':19B 'plugin':3A,28B,74C 'post':11A,64B,108C 'publish':6A,58B,70B,102C,116C 'role':52B,96C 'self':21B 'self-host':20B 'set':9A,62B,106C 'setup':42B,89C 'tour':7A,39B,59B,86C,103C 'user':34B,48B,81C,92C 'wizard':43B,90C 'wordpress':2A,23B,27B,73C 'wpvr':1A,24B,26B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPVR plugin before 9.1.3 that allow Contributor-level or higher accounts to log in. Sites without the plugin, or with it at 9.1.3 or later, are not affected. Sites where only administrators and editors have accounts face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114740","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}