PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114741 WPVR CVE debrief

CVE-2026-114741 is a vulnerability in the WPVR WordPress plugin that allows users with contributor-level access and above to read and modify virtual tours created by other users due to a lack of object-level authorization checks. This vulnerability affects WordPress installations using the WPVR plugin, particularly those with multiple contributors or users with elevated access. The vulnerability has been publicly disclosed, and administrators should assess exposure and prioritize remediation to prevent potential unauthorized access and data modification.

Vendor
WPVR
Product
WPVR
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-25
Original CVE updated
2026-10-25
Advisory published
2026-10-25
Advisory updated
2026-10-25

Who should care

WordPress administrators, security teams, and users with elevated access to WordPress installations using the WPVR plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-114741 is a vulnerability in the WPVR WordPress plugin that allows unauthorized access to and modification of virtual tours. WordPress administrators and security teams should assess exposure and prioritize remediation to prevent potential unauthorized access and data modification.

  • Potential unauthorized access to sensitive virtual tour data
  • Possible modification of virtual tours by unauthorized users
  • Need for verification of user access controls and authorization checks
  • Priority for remediation of vulnerable WPVR plugin versions

Technical summary

The WPVR WordPress plugin before version 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users. The vulnerability is due to insufficient access controls, which could lead to unauthorized access and modification of virtual tours. WordPress administrators and security teams should verify user access controls and authorization checks, and prioritize remediation for installations with multiple contributors or elevated W

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the WPVR plugin, especially those with multiple contributors or users with elevated access.

Recommended defensive actions

  • Assess WordPress installations for WPVR plugin usage and version
  • Verify user access controls and authorization checks
  • Prioritize remediation for installations with multiple contributors or elevated user access
  • Monitor for suspicious activity related to virtual tours

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114741 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114741

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114741 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114741

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.