CVE-2026-114742 in WPVR Plugin
Summary
by MITRE • 10/25/2026
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in the WPVR WordPress plugin prior to version 9.0.3 represents a critical failure in authorization logic within the application's content management workflow. Specifically, the flaw resides in the mechanism used for updating virtual tour objects. When an authenticated user initiates an update request for a specific virtual tour resource, the backend processing does not verify whether the requesting user is the legitimate owner of that object or possesses sufficient administrative privileges to alter it. This absence of object-level ownership checks creates a direct path for unauthorized modification of content belonging to other users within the same WordPress installation.
From a technical perspective, this issue classifies as an Insecure Direct Object Reference combined with Broken Access Control vulnerabilities. The application relies on user session authentication but fails to enforce proper authorization policies at the resource level. Consequently, any authenticated account holding contributor-level access or higher can manipulate the internal identifiers of virtual tours belonging to other contributors, authors, editors, or administrators. By intercepting and modifying HTTP requests associated with tour updates, an attacker can alter metadata, media assets, configuration settings, and publication status without permission from the original creator.
The operational impact of this vulnerability is significant for multi-author WordPress environments where content integrity and user privacy are paramount. An adversary exploiting this flaw could deface websites by replacing virtual tours with malicious or inappropriate content, thereby damaging the reputation of both individual contributors and the hosting organization. Furthermore, because the attacker can reconfigure tour settings, they may inject cross-site scripting payloads into tour descriptions or metadata fields that are subsequently rendered in users' browsers. This transforms a simple authorization bypass into a potential vector for persistent web attacks against site visitors who view the compromised tours.
Additionally, the ability to publish tours created by others allows attackers to spread malicious content under the guise of legitimate user-generated material. This undermines trust within collaborative platforms and complicates forensic analysis since actions appear to originate from valid contributor accounts rather than external intruders. The lack of audit trails specific to ownership changes means that detecting such tampering after the fact is difficult, requiring proactive monitoring of access logs for anomalous update patterns.
To mitigate this vulnerability, site administrators must immediately upgrade the WPVR plugin to version 9.0.3 or later, where these authorization checks have been implemented. Until an update can be applied, implementing a Web Application Firewall with rules that monitor and restrict bulk updates from contributor-level accounts may provide partial protection by limiting the frequency of modification requests. It is also advisable to review user roles within WordPress and ensure that only trusted individuals are assigned elevated permissions such as editor or administrator levels. Regular security audits focusing on access control logic across all custom plugins will help identify similar flaws before they can be exploited in production environments.
This vulnerability aligns with Common Weakness Enumeration identifiers CWE-284, which covers Improper Access Control, and CWE-639, concerning Authorization Bypass Through User-Controlled Key. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1078 Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions, and potentially T1505 Server Software Component if the modified tours are used to deploy further malicious components via embedded scripts or links.