Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:00:21 UTC
CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedOct 25, 2026 06:00:21 UTC
PublishedOct 25, 2026 06:00:21 UTC
ReservedOct 22, 2026 03:35:15 UTC
Credits
- Huseyn Huseynov
- WPScan