CVE-2026-114742: CWE-639 Authorization Bypass Through User-Controlled Key in WPVR
Affects WPVRSource CVE Database V5
Not known to be exploited · fixed in 9.0.3 : patch WPVR soon.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- Patch
- Available – fixed in 9.0.3
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WPVR | Affected
| Fixed in
|
AI-suggested
Upgrade WPVR to version 9.0.3 or later where this authorization bypass vulnerability has been fixed. No other mitigation guidance is provided. Patch status is confirmed by the version range indicating fixed in 9.0.3.
Description
The WPVR WordPress plugin versions 8.3.0 up to but not including 9.0.3 have an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to update virtual tours created by other users without proper ownership checks. As a result, unauthorized modification, reconfiguration, and publishing of other users' virtual tours is possible.
Impact
Users with contributor-level access or higher can modify, reconfigure, and publish virtual tours created by other users. This could lead to unauthorized content changes and potential misuse of the virtual tour functionality within affected WordPress sites.
Weaknesses
- CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.