Unauthorized Data Access Vulnerability in WP VR – 360 Panorama Plugin by WordPress

CVE-2025-12005

What is CVE-2025-12005?

The WP VR – 360 Panorama and Free Virtual Tour Builder for WordPress is susceptible to a serious flaw where it fails to properly validate user permissions before allowing actions. This vulnerability potentially enables authenticated users with contributor or higher roles to gain unauthorized access to sensitive plugin settings. Consequently, attackers can modify critical configuration options, leading to potential exploitation of the website. It is essential for users to update to secure versions to mitigate the risk.

References