---
id: CVE-2026-114740
title: >-
  WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via
  Setup Wizard
summary: >-
  The WPVR  WordPress plugin before 9.1.3 does not correctly check user
  capabilities when creating a tour through its setup wizard, allowing users
  with the Contributor role and above to create and publish tour content and set
  arbitrary pos…
severity: none
cwe:
  - CWE-862
product: WPVR
affected:
  - WPVR >= 8.5.55 < 9.1.3
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T06:00:21.122Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114740'
references:
  - url: 'https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d/'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06088
ingestedAt: '2026-10-25T22:08:29.963Z'
---

## Overview

The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

## Affected

- `WPVR >= 8.5.55 < 9.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.