CVE-2026-114742 WPVR CVE debrief

Who should care

WordPress administrators and security teams responsible for managing WPVR plugin installations should assess exposure and prioritize remediation.

Why it matters

CVE-2026-114742 allows users with contributor-level access to modify, reconfigure, and publish virtual tours created by other users in the WPVR WordPress plugin before version 9.0.3. WordPress administrators and security teams should assess exposure and prioritize remediation to prevent unauthorized changes to virtual tours.

• Potential unauthorized modification of virtual tours by users with contributor-level access.
• Possible reconfiguration of tours by unauthorized users.
• Potential publication of modified tours by unauthorized users.

Technical summary

The WPVR WordPress plugin before version 9.0.3 lacks object-level ownership checks for virtual tour updates. This vulnerability allows users with contributor-level access and above to modify tours created by other users. The technical impact of this vulnerability is that it could lead to unauthorized changes to virtual tours, potentially affecting the integrity of the tours and the users who created them. The vulnerability is grounded in the plugin's failure to implement proper access controls for tour updates.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the WPVR plugin.

Recommended defensive actions

• Assess WordPress installations for WPVR plugin usage and version.
• Verify if object-level ownership checks are implemented in WPVR plugin version 9.0.3 or later.
• Restrict contributor-level access and above to only authorized users.

Evidence notes

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This lack of checks allows users with contributor-level access and above to modify, reconfigure, and publish tours created by other users. The evidence for this vulnerability comes from CVE Program and NVD records, which provide details on the affected plugin version and the nature of the vulnerability. Defenders should verify the version of the WPVR plugin in use and plan

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.