Live › vulnerability › CVE-2026-114742
Go to dashboardThe WPVR WordPress plugin before 9.0.3 does not check object ownership when updating virtual tours. A logged-in user with contributor access or higher can change, reconfigure and publish tours created by other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the WPVR WordPress plugin before 9.0.3 that have users with contributor-level access or higher. Sites without WPVR, or with only administrators and editors who are trusted to edit all tours, face less risk from this specific flaw.
No product ranges from the sources yet.
wp plugin get wpvr --field=version9.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-114742")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.