CVE-2025-12005

WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update

View on CVE.org
Published Oct 25, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.

Analysis

AI-generated

Technical impact

The plugin contains an improper authorization flaw that allows users with contributor-level or higher permissions to modify sensitive settings. By bypassing the expected permission checks, an authenticated attacker can alter configuration options. Based on the description, it is inferred that modifying these options may affect site appearance or functionality, potentially enabling further compromise or degrading user experience.

Affected Systems

This issue affects the WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin distributed by rextheme. Every release up to and including version 8.5.41 is vulnerable, making all sites that have that plugin installed susceptible until they upgrade beyond 8.5.41.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1% means the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the vulnerability is exploitable by any authenticated contributor or administrator, so mitigating by updating the plugin or blocking contributor roles remains advisable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WP VR plugin to the latest available version that addresses the authorization issue.
  • Remove or reduce contributor-level access on sites that do not require it, limiting the number of users who could exploit the flaw.
  • Regularly review plugin settings to ensure no unexpected changes have been applied, and consider disabling the vulnerable settings until a patch is applied.

Generated by OpenCVE AI on April 22, 2026 at 14:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Rextheme
Rextheme wp Vr
Wordpress
Wordpress wordpress
Vendors & Products Rextheme
Rextheme wp Vr
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.
Title WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update
Weaknesses CWE-285
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 5:11 PM
Reserved
Oct 21, 2025, 6:47 AM

View source JSON

Updated
Oct 27, 2025, 3:56 PM

JSON

Status
Deferred
Published
Oct 25, 2025, 6:15 AM
Modified
Oct 8, 2026, 11:10 AM

View source JSON

No data.

Updated
Apr 22, 2026, 2:15 PM

JSON