Security Alert Summary
The WPVR WordPress plugin before 9.0.3 fails to perform object-level ownership checks when updating virtual tours. This allows authenticated users with contributor-level access and above to modify, reconfigure, and publish tours created by other users.
CVE Details
- CVE ID:
CVE-2026-114742 - Affected component: WPVR WordPress plugin
- Affected versions: 8.3.0 and other versions less than 9.0.3
- Published: October 25, 2026 at 6:16:31 AM UTC
- Last modified: October 25, 2026 at 6:16:31 AM UTC
- CVSS v3.1: Not provided
- Authentication / privileges: Authenticated users; contributor-level or higher
- User interaction: Not required beyond normal authenticated actions
- Impact: Integrity – unauthorized modification, reconfiguration, and publishing of virtual tours; Confidentiality – potential exposure of tour content; Availability – not indicated
- CWE / weakness ID: Not provided
Technical Details
The WPVR plugin does not perform object-level ownership checks when updating virtual tours. In other words, the code path that handles updates to tour objects does not verify that the authenticated user is the owner of, or otherwise authorized to modify, the specific tour being changed. Because of this missing authorization check, any user with contributor-level access or higher can update, reconfigure, and publish tours created by other users.
No specific functions or REST API endpoints are named in the provided advisory. The root cause is a missing object-level authorization check on tour update operations rather than an authentication bypass.
The impact is limited to the operations described in the advisory: unauthorized modification and publishing of other users’ virtual tours. The available data does not indicate remote code execution, arbitrary file access, or complete site compromise.
How This Could Impact Your Website
On a site with several roles—site owner, editor, internal contributor, and an external contractor with contributor access—a contractor account that is compromised or used maliciously could edit or publish virtual tours owned by other team members. That may lead to incorrect or misleading content being published, unwanted configuration changes to tours, or exposure of information embedded in tour content.
Practical consequences include possible exposure of internal user email addresses or other data contained in tours and an increased risk of targeted phishing or social engineering based on modified tour content. Changes made by contributors may also require administrator time to detect and revert, disrupting normal operations.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and audit logs for unusual behavior related to virtual tour updates and publishing.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
