What is GHSA-w69v-pr8w-66wj?

GHSA-w69v-pr8w-66wj is a security advisory published by GitHub Security Advisories with Medium severity. The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating...

Which CVE IDs does GHSA-w69v-pr8w-66wj cover?

GHSA-w69v-pr8w-66wj covers the following CVE IDs: CVE-2026-114740. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w69v-pr8w-66wj?

GHSA-w69v-pr8w-66wj has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-w69v-pr8w-66wjMediumCVSS 4.9

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-114740 →

📋 Description

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-114740
https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d
https://github.com/advisories/GHSA-w69v-pr8w-66wj