---
id: "CVE-2026-114740"
kind: "vulnerability"
aliases: ["CVE-2026-114740"]
title: "WPVR WordPress plugin: contributors can publish tours and set arbitrary post metadata"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvr"]
not_affected_if: ["no-contributor-accounts", "plugin-at-9.1.3-or-later"]
published_at: "2026-10-25T06:16:31+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114740", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# WPVR WordPress plugin: contributors can publish tours and set arbitrary post metadata

The WPVR WordPress plugin before 9.1.3 fails to check user capabilities when creating a tour through its setup wizard. A logged-in user with the Contributor role or higher can create and publish tour content and set arbitrary post metadata they could not normally publish.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPVR version in the WordPress admin plugin list or with `wp plugin get wpvr --field=version`
- Review recently created or published tour posts and post metadata for entries from Contributor-level accounts

## Fix

- Update the WPVR plugin to `9.1.3` or later
- Review Contributor and higher accounts if the plugin was on an earlier version

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114740

## From the sources

The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_