CVE-2026-114741: CWE-639 Authorization Bypass Through User-Controlled Key in WPVR
Affects WPVRSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WPVR | Affected
| Fixed in
|
AI-suggested
Upgrade the WPVR plugin to version 9.0.3 or later, where the authorization bypass vulnerability has been fixed. No other mitigation steps are indicated by the vendor advisory.
Description
The WPVR WordPress plugin versions 9.0.0 through 9.0.2 contain an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to read and modify virtual tours created by other users due to missing object-level authorization checks. The issue is fixed starting from version 9.0.3.
Impact
Users with contributor-level access or higher can read and modify virtual tours created by other users, potentially leading to unauthorized data exposure and modification within the affected WordPress environment. This could undermine data integrity and confidentiality of virtual tours managed by the plugin.
Weaknesses
- CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.