CVE-2026-114740

The WPVR WordPress plugin before version 9.1.3 is vulnerable to a privilege escalation flaw. The plugin fails to correctly validate user capabilities during the setup wizard tour creation process. This allows users with the Contributor role and above to create and publish tour content and set arb...