WordPress Plugin Vulnerabilities

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

Description

The plugin does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

Proof of Concept

Affects Plugins

Plugin icon
wpvr
Fixed in 9.0.3

References

CVE
CVE-2026-114741

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
RIA Labs
Submitter
RIA Labs
Verified
Yes
WPVDB ID
bfa704b5-b934-4615-aa75-d50b28baedf7

Timeline

Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-23 (about 1 day ago)

Other

Published
Title
Published
2026-08-15
Title
Forminator Forms < 1.55.1 - Unauthenticated Draft Form Entry Disclosure via 'draft' Parameter
Published
2024-11-19
Title
Image Optimizer, Resizer and CDN – Sirv < 7.3.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion
Published
2026-10-05
Title
JS Help Desk – AI-Powered Support & Ticketing System < 5.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-12-11
Title
Ultra Addons for Contact Form 7 < 3.5.34 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
Published
2026-04-10
Title
Tutor LMS < 3.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification