CVE-2026-114740
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Description
CNA (WPScan)
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WPVR | affected: 8.5.55 … < 9.1.3 default: unaffected |
Linux distribution status
References (1)
- https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d/ CNA exploitvdb-entrytechnical-description