CVE-2026-114740 WPVR CVE debrief

Who should care

Defenders responsible for WordPress installations with the WPVR plugin should assess exposure and prioritize verification of user role capabilities in versions before 9.1.3. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify user role capabilities and assess potential impact on affected versions.

Why it matters

CVE-2026-114740 allows users with Contributor role and above to create and publish tour content and set arbitrary post metadata in WPVR plugin versions before 9.1.3. Defenders should assess exposure, prioritize verification of user role capabilities, and remediate affected versions.

• Potential unauthorized creation and publication of tour content by users with Contributor role and above
• Potential modification of arbitrary post metadata by users with Contributor role and above
• Verification of user role capabilities required to prevent potential abuse
• Remediation priority for WPVR plugin versions before 9.1.3

Technical summary

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish. This vulnerability requires verification of user role capabilities and potential impact on affected versions.

Defensive priority

Assess exposure and prioritize verification of user role capabilities in WPVR plugin versions before 9.1.3.

Recommended defensive actions

• Verify user role capabilities in WPVR plugin versions before 9.1.3
• Assess exposure and prioritize remediation for affected versions
• Monitor for potential abuse of tour content creation and post metadata modification
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected versions and potential impact. The vulnerability details are based on the CVE Program record and NVD entry. The WPVR plugin before 9.1.3 is affected, but specific details about the vulnerability and its impact are limited. Defenders should verify user role capabilities and assess exposure to potential abuse.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.