Technical impact
The vulnerability is an Insecure Direct Object Reference that allows users with contributor-level or higher access to update, reconfigure, and publish virtual tours created by other users. By omitting ownership checks when a tour is edited, the plugin permits unauthorized modification of any tour object, potentially changing visual content, metadata, or publication status. This flaw undermines data integrity and could be leveraged to spread misinformation or alter user experiences without the original creator’s consent.
Affected Systems
WordPress sites that use the WPVR plugin before version 9.0.3 are affected. The issue applies to all releases from 8.3.0 up to and including 9.0.2, regardless of the hosting platform or deployment environment.
Risk and Exploitability
A legitimate contributor or higher role can exploit the flaw simply by interacting with the plugin’s tour management interface; no remote code execution or elevated privileges beyond the existing role are required. The vulnerability has a CVSS score of 2.7 and an EPSS score of < 1 % and is not listed in the CISA KEV catalog, indicating that no widespread exploitation reports have emerged yet. Nevertheless, the impact on integrity can be significant if an attacker defaces or republishes a tour, and the ease of exploitation warrants prompt remediation.
