{"id":"CVE-2026-114741","revision":"4556d94745c04963bb4df2f6e5402816","records":[{"revision":"4556d94745c04963bb4df2f6e5402816","observedAt":"2026-10-25T07:17:04.345+00:00","statement":{"source":"cve-program","id":"CVE-2026-114741","aliases":[],"title":"WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR","description":"The WPVR  WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.","state":0,"publishedAt":"2026-10-25T06:00:21.321+00:00","modifiedAt":"2026-10-25T06:00:21.321+00:00","affected":[{"ecosystem":"Vendor product","name":"WPVR","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WPVR\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"9.0.0\",\n                            \"lessThan\": \"9.0.3\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/bfa704b5-b934-4615-aa75-d50b28baedf7/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114741","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114741","identifiers":["CVE-2026-114741"]},"retained":false,"historicalAffected":[]}],"coverage":[]}