CVE-2025-12005: WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12005?
CVE-2025-12005 is classified as a medium severity vulnerability due to unauthorized access risks.
How do I fix CVE-2025-12005?
To fix CVE-2025-12005, update the WP VR – 360 Panorama and Free Virtual Tour Builder plugin to version 8.5.42 or later.
What versions of the plugin are affected by CVE-2025-12005?
CVE-2025-12005 affects all versions of the WP VR – 360 Panorama and Free Virtual Tour Builder plugin up to and including 8.5.41.
What kind of access does CVE-2025-12005 allow?
CVE-2025-12005 allows unauthorized users to gain access to sensitive data due to inadequate action authorization checks.
Is there a patch available for CVE-2025-12005?
Yes, a patch for CVE-2025-12005 is available in the latest version of the plugin released after 8.5.41.