[ CVE-2026-114740 · Published 25 Oct 2026 ]
Vulnerability in Unknown WPVR
Not scored yet
No fix listed yet
[ Description ]Official description
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.