Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPVR | 9.0.0 – < 9.0.3 | 9.0.3 |
References
- https://wpscan.com/vulnerability/bfa704b5-b934-4615-aa75-d50b28baedf7/ exploit vdb-entry technical-description