Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:00:21 UTC
CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedOct 25, 2026 06:00:21 UTC
PublishedOct 25, 2026 06:00:21 UTC
ReservedOct 22, 2026 03:34:23 UTC
Credits
- RIA Labs
- WPScan