Live › vulnerability › CVE-2026-114741
Go to dashboardThe WPVR WordPress plugin before 9.0.3 skips per-object ownership checks when reading and updating virtual tours. A logged-in user with contributor-level access or higher can view and modify tours created by other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the WPVR WordPress plugin before 9.0.3 that give contributor-level or higher accounts to people who should not see each other's tours. Sites with no contributor-level users, or where only trusted editors hold accounts, have a lower practical risk.
No product ranges from the sources yet.
wp-content/plugins/wpvr/ and compare it with 9.0.3.9.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-114741")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.