# CVE-2026-114742: WPVR WordPress plugin authorization bypass in virtual tour updates

Source: https://junglewise.ai/threats/cve-2026-114742-the-wpvr-wordpress-plugin-before-9-0-3-does-not-perform-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-114742 · Severity: info · Published 2026-10-25

WPVR is a WordPress plugin used to create and manage virtual tours on websites. The plugin fails to verify ownership of tours before allowing edits, allowing contributors and above to modify, reconfigure, and publish tours created by other users. This could result in defacement, unauthorized changes to tour content, or publication of malicious tours without the original owner's knowledge.

Technologies: [WPVR](https://junglewise.ai/threats/technologies/wpvr). Vendors: [WPVR](https://junglewise.ai/threats/vendors/wpvr).

## Quick answers

**Is CVE-2026-114742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114742 being exploited in the wild.

**How severe is CVE-2026-114742?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** WPVR 8.3.0 to 9.0.2.

**Is there a fix for CVE-2026-114742?** Yes: fixed in 9.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114742 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114742?** Check whether you run WPVR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.0.3

## Technical details

The plugin has an insecure direct object reference (IDOR) vulnerability where it does not perform object-level ownership checks during virtual tour updates. An authenticated attacker with contributor-level or higher privileges can bypass access controls to modify tours they do not own via unauthenticated direct object references to tour identifiers. A fix is available in version 9.0.3.

## Affected products

- WPVR WPVR 8.3.0 to 9.0.2

## Timeline

- 2026-10-23: disclosed
- 2026-10-25: advisory

## References

- [https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/](https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/)

## Related threats

- [WPVR WordPress plugin capability check bypass](https://junglewise.ai/threats/cve-2026-114740-the-wpvr-wordpress-plugin-before-9-1-3-does-not-correctly-check)
- [WPVR WordPress plugin stored XSS in tour hotspot content](https://junglewise.ai/threats/cve-2026-114429-the-wpvr-wordpress-plugin-before-9-0-3-does-not-properly)