Technical impact
The WPVR WordPress plugin versions 9.0.0 through 9.0.2 allows users with contributor privileges or higher to read and change virtual tours that do not belong to them. Because the plugin fails to verify that the current user is the owner of the tour in question, an attacker who can authenticate as a contributor can reveal confidential tour information or alter existing tours, potentially affecting content integrity and confidentiality.
Affected Systems
WordPress sites running the WPVR plugin in any version from 9.0.0 up to, but not including, 9.0.3 are affected. Installations still using the 9.0.2 or earlier releases must be upgraded to 9.0.3 or later to eliminate the vulnerability. The problem is limited to the WPVR plugin and does not affect other WordPress components directly.
Risk and Exploitability
The vulnerability is an Insecure Direct Object Reference (IDOR). Exploitation requires an authenticated user with at least contributor privileges to send requests to the plugin's API. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, and the flaw is not listed in CISA KEV, suggesting no documented public exploits. If exploited, the flaw would allow a contributor‑level actor to read or modify any virtual tour, compromising confidentiality and integrity of content. The CVSS score of 3.8 reflects low severity, and the risk is largely limited to sites that still host vulnerable WPVR versions and have users with contributor or higher roles.
