{"id":"CVE-2026-114742","revision":"5c5c821c10894156950cfb8f2e13f114","records":[{"revision":"5c5c821c10894156950cfb8f2e13f114","observedAt":"2026-10-25T07:17:04.345+00:00","statement":{"source":"cve-program","id":"CVE-2026-114742","aliases":[],"title":"WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR","description":"The WPVR  WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.","state":0,"publishedAt":"2026-10-25T06:00:21.497+00:00","modifiedAt":"2026-10-25T06:00:21.497+00:00","affected":[{"ecosystem":"Vendor product","name":"WPVR","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WPVR\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"8.3.0\",\n                            \"lessThan\": \"9.0.3\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114742","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114742","identifiers":["CVE-2026-114742"]},"retained":false,"historicalAffected":[]}],"coverage":[]}