UNKNOWN NVD

CVE-2026-114740

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contri

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

References

https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d/

Published: 2026-10-25 · Source: NVD · Feed updated: 2026-10-25

This unknown severity vulnerability was published on 2026-10-25 via NVD.

vulnfeed aggregates 17058 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.