Threats tagged 'ghsa-vqjh-3q2x-jp9r'

The WPVR WordPress plugin versions 9.0.0 through 9.0.2 contain an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to read and modify virtual tours created by other users due to missing object-level authorization checks. The issue is fixed starting from version 9.0.3.