Threats tagged 'ghsa-jgxg-6f9p-7gm5'

The WPVR WordPress plugin versions 8.3.0 up to but not including 9.0.3 have an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to update virtual tours created by other users without proper ownership checks. As a result, unauthorized modification, reconfiguration, and publishing of other users' virtual tours is possible.