Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:00:21 UTC

CVE-2026-114740

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

Base scoreN/A/ 10

SeverityNoneCVSS unscored

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityNone

No CVSS vector is available for this record.

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityWPScan

Last updatedOct 25, 2026 06:00:21 UTC

PublishedOct 25, 2026 06:00:21 UTC

ReservedOct 22, 2026 03:32:37 UTC

Credits

an7ln
WPScan