CVE-2026-114740: CWE-862 Missing Authorization in WPVR
Affects WPVRSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WPVR | Affected
| Fixed in
|
AI-suggested
Upgrade WPVR to version 9.1.3 or later where this authorization issue is fixed. No other mitigation guidance is provided. Patch status is not explicitly confirmed in the input, but the version range indicates the issue is fixed starting at 9.1.3.
Description
A missing authorization vulnerability in the WPVR WordPress plugin before version 9.1.3 allows users with the Contributor role and above to create and publish tour content via the setup wizard. This flaw permits these users to set arbitrary post metadata that they would not normally be authorized to create or publish.
Impact
Users with Contributor role and above can bypass intended permission restrictions to create and publish tour content and set arbitrary post metadata. This could lead to unauthorized content publication and potential manipulation of site content metadata, impacting site integrity and content control.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.