CVE-2026-104386 WPFunnels Team CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP VR plugin, especially those with high-risk configurations or sensitive data, should assess their exposure and take necessary actions to secure their environments.

Why it matters

Defenders should prioritize verifying and securing WP VR plugin configurations due to the risk of exploitation of incorrectly configured access control security levels, which could lead to unintended access or modifications.

• Verification of access control security levels for WP VR plugin configurations
• Potential unintended access or modifications due to exploitation of incorrectly configured security levels
• Monitoring for exploitation attempts targeting WP VR plugin vulnerabilities

Technical summary

The WP VR plugin for WordPress, versions up to 9.1.3, contains a Missing Authorization vulnerability. This issue allows attackers to exploit incorrectly configured access control security levels, potentially leading to unintended access or modifications.

Defensive priority

Defenders should prioritize verifying the configuration of access control security levels for the WP VR plugin, especially in environments where the plugin is used.

Recommended defensive actions

• Verify the configuration of access control security levels for the WP VR plugin
• Review and update the plugin version to 9.1.3 or later if necessary
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.