CVE-2026-114740— WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
Quick assessment
Affected
Unknown WPVR
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WPVR WordPress 插件在 9.1.3 版本之前，通过其设置向导创建游览（tour）时未能正确检查用户权限，导致拥有“贡献者”（Contributor）角色及更高权限的用户能够创建并发布游览内容，并设置他们原本无法创建或发布的任意文章元数据。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114740
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
Source: CVE Program / CVE List V5
Vulnerability Description
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114740
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114740
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total
| CVE-2026-114743 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin | |
| CVE-2026-115183 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget | |
| CVE-2026-115214 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol | |
| CVE-2026-115251 | Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click | |
| CVE-2026-114742 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR | |
| CVE-2026-114741 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR | |
| CVE-2026-111979 | GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color | |
| CVE-2026-111980 | GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability | |
| CVE-2026-111981 | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad | |
| CVE-2026-111978 | GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import | |
| CVE-2026-111976 | GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou | |
| CVE-2026-110285 | WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web | |
| CVE-2025-15705 | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS | |
| CVE-2026-94295 | Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-114743
InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Up -
CVE-2026-115183
Qi Addons For Elementor < 1.11.2 - Contributor+ Content Inje -
CVE-2026-115214
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege -
CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PH -
CVE-2026-114742
WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via