{"id":"CVE-2026-114741","kind":"vulnerability","aliases":["CVE-2026-114741"],"related":[],"title":"WPVR WordPress plugin lets contributors read and edit other users' tours","description":"The WPVR  WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.","summary":"The WPVR WordPress plugin before 9.0.3 skips per-object ownership checks when reading and updating virtual tours. A logged-in user with contributor-level access or higher can view and modify tours created by other users.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvr"],"not_affected_if":["no-contributor-accounts","plugin-version-9.0.3-or-later"],"how_to_check":"- Check the installed WPVR version in the WordPress admin plugin list or in `wp-content/plugins/wpvr/` and compare it with `9.0.3`.\n- Review which accounts hold contributor role or higher on sites running WPVR.","fix":"- Update the WPVR plugin to `9.0.3` or later.","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:36+00:00","updated_at":"2026-10-25T06:37:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T06:37:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WPVR plugin to `9.0.3` or later.","reach":"internet","title":"WPVR WordPress plugin lets contributors read and edit other users' tours","impact":"medium","summary":"The WPVR WordPress plugin before 9.0.3 skips per-object ownership checks when reading and updating virtual tours. A logged-in user with contributor-level access or higher can view and modify tours created by other users.","category":"package","nicknames":[],"who_cares":["wordpress","wpvr","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Contributor users read and overwrite other users' virtual tours","analyst_note":"","how_to_check":"- Check the installed WPVR version in the WordPress admin plugin list or in `wp-content/plugins/wpvr/` and compare it with `9.0.3`.\n- Review which accounts hold contributor role or higher on sites running WPVR.","needs_analyst":false,"not_affected_if":["plugin-version-9.0.3-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the WPVR WordPress plugin before `9.0.3` that give contributor-level or higher accounts to people who should not see each other's tours. Sites with no contributor-level users, or where only trusted editors hold accounts, have a lower practical risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000578,"input_tokens":3281,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114741':14A,17A '-2026':13A,16A '9.0.3':29B,68C 'access':51B,89C 'allow':83C 'author':75C 'check':35B,76C 'contributor':5A,49B,87C 'contributor-level':48B,86C 'creat':59B,97C 'cve':12A,15A 'edit':8A 'higher':53B 'host':21B 'let':4A 'level':50B,74C,88C 'log':44B 'logged-in':43B 'modifi':57B,95C 'object':33B,73C 'object-level':72C 'ownership':34B 'packag':18B 'per':32B 'per-object':31B 'perform':71C 'plugin':3A,27B,66C 'read':6A,37B,78C,93C 'self':20B 'self-host':19B 'skip':30B 'tour':11A,41B,58B,82C,96C 'updat':39B,80C 'user':10A,46B,62B,84C,100C 'view':55B 'virtual':40B,81C 'wordpress':2A,22B,26B,65C 'wpvr':1A,23B,25B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPVR WordPress plugin before `9.0.3` that give contributor-level or higher accounts to people who should not see each other's tours. Sites with no contributor-level users, or where only trusted editors hold accounts, have a lower practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114741","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}