CVE-2026-114742: WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

Q: Which users can exploit this issue?

Any authenticated user with contributor-level access or a higher role can exploit it. The affected action is updating virtual tours that were created by other users.

Q: What could an attacker do with access to a contributor account?

They could modify, reconfigure, or publish another user's virtual tours. Exploitation relies on the absence of object-level ownership checks during tour updates.

Q: Which plugin versions are affected?

WPVR versions before 9.0.3 are affected. The reported affected range includes versions 8.3.0 through 9.0.2.

Q: How can I determine whether my site is exposed?

Check whether WPVR is installed at a version earlier than 9.0.3 and whether untrusted users have contributor or higher access. Affected sites may allow one such user to update a virtual tour belonging to a different user.

Published Oct 25, 2026

Updated

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

Affected Software

1 affected component

WPVR WP VR<9.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPVR WordPress plugin to a version that resolves this vulnerability.
Fixed in 9.0.3

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user with contributor-level access or a higher role can exploit it. The affected action is updating virtual tours that were created by other users.

What could an attacker do with access to a contributor account?

They could modify, reconfigure, or publish another user's virtual tours. Exploitation relies on the absence of object-level ownership checks during tour updates.

Which plugin versions are affected?

WPVR versions before 9.0.3 are affected. The reported affected range includes versions 8.3.0 through 9.0.2.

How can I determine whether my site is exposed?

Check whether WPVR is installed at a version earlier than 9.0.3 and whether untrusted users have contributor or higher access. Affected sites may allow one such user to update a virtual tour belonging to a different user.

CVE-2026-114742: WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What could an attacker do with access to a contributor account?

Which plugin versions are affected?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What could an attacker do with access to a contributor account?

Which plugin versions are affected?

How can I determine whether my site is exposed?