CVE-2026-114740: WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

Q: Which users can exploit this issue?

Users with the Contributor role or any higher-privileged role can exploit the setup wizard capability check flaw. Exploitation requires an authenticated WordPress account with at least Contributor access.

Q: What can an attacker do through the vulnerable setup wizard?

They can create and publish WP VR tour content and set arbitrary post metadata, despite lacking the normal permissions to create or publish that content.

Q: Which plugin versions are affected?

WP VR versions before 9.1.3 are affected. Versions 9.1.3 and later are not identified as affected by the provided information.

Published Oct 25, 2026

Updated

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

Affected Software

1 affected component

WP VR WP VR WordPress plugin>=8.5.55<=9.1.2

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with the Contributor role or any higher-privileged role can exploit the setup wizard capability check flaw. Exploitation requires an authenticated WordPress account with at least Contributor access.

What can an attacker do through the vulnerable setup wizard?

They can create and publish WP VR tour content and set arbitrary post metadata, despite lacking the normal permissions to create or publish that content.

Which plugin versions are affected?

WP VR versions before 9.1.3 are affected. Versions 9.1.3 and later are not identified as affected by the provided information.

CVE-2026-114740: WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What can an attacker do through the vulnerable setup wizard?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What can an attacker do through the vulnerable setup wizard?

Which plugin versions are affected?