Object-Level Ownership Check Flaws in WPVR WordPress Plugin
CVE-2026-114742
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-114742?
The WPVR WordPress plugin, prior to version 9.0.3, is susceptible to a security deficiency that fails to adequately enforce object-level ownership checks when users update virtual tours. This allows individuals with contributor privileges or higher to modify, reconfigure, and even publish virtual tours originally created by other users, posing a risk of unauthorized content manipulation in a multi-user environment.
Affected Version(s)
WPVR 8.3.0 < 9.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.