The plugin contains an improper authorization flaw that allows users with contributor-level or higher permissions to modify sensitive settings. By bypassing the expected permission checks, an authenticated attacker can alter configuration options. Based on the description, it is inferred that modifying these options may affect site appearance or functionality, potentially enabling further compromise or degrading user experience.

This issue affects the WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin distributed by rextheme. Every release up to and including version 8.5.41 is vulnerable, making all sites that have that plugin installed susceptible until they upgrade beyond 8.5.41.

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1% means the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the vulnerability is exploitable by any authenticated contributor or administrator, so mitigating by updating the plugin or blocking contributor roles remains advisable.