CVE-2026-114740
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
| Vendor | unknown |
| Product | wpvr |
| Published | Oct 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wpvr
Be the first to know when new unknown vulnerabilities affecting unknown wpvr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WPVR
8.5.55 < 9.1.3
References
Credits
an7ln WPScan