CVE-2026-104386: Missing Authorization in WPFunnels Team WP VR

This vulnerability in WP VR involves missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The issue affects all versions from the initial release through 9.1.3. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, requiring low privileges and user interaction, and results in partial compromise of confidentiality, integrity, and availability. No known exploits are reported in the wild, and no vendor patch or advisory details are provided in the input data.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to bypass access controls, leading to partial disclosure of information, modification of data, and disruption of service within the affected WP VR plugin. The impact is rated medium severity based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the plugin and limit user privileges where possible to reduce risk.