Technical impact
The plugin fails to verify user capabilities when a tour is created through its setup wizard. Contributors and higher roles can therefore create and publish tours, and can also set arbitrary post metadata that they normally could not control, effectively giving them elevated privileges. This allows unauthorized or malicious content to appear on the site, compromising the integrity of tour data.
Affected Systems
WordPress plugin WPVR, versions prior to 9.1.3 are affected. Any WordPress installation using the plugin in these versions is vulnerable.
Risk and Exploitability
The flaw permits exploitation by any authenticated user with the Contributor role or higher. No additional network privileges are required beyond WordPress's standard authentication. The EPSS score is < 1%, indicating a very low probability of exploitation in the wild, and the CVSS score of 4.9 classifies the vulnerability as moderate severity. Though not listed in CISA’s KEV catalog, the lack of proper capability checks allows an attacker to use the setup wizard interface to create or modify tour content, and to set arbitrary post metadata that they normally cannot control, potentially injecting hidden links or misleading information.
