User Role Bypass in WPVR Plugin Affects WordPress Tour Creation
CVE-2026-114740
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-114740?
The WPVR plugin for WordPress prior to version 9.1.3 is susceptible to a user role bypass vulnerability. This flaw occurs during the setup wizard, where insufficient validation of user capabilities allows individuals with Contributor roles and above to create and publish tour content improperly. Furthermore, this exploitation enables these users to set arbitrary post metadata that they typically lack permission to manage, potentially leading to unauthorized access and manipulation of site content.
Affected Version(s)
WPVR 8.5.55 < 9.1.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.