Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPVR | 8.3.0 – < 9.0.3 | 9.0.3 |
References
- https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/ exploit vdb-entry technical-description