WP VR CVE-2026-104386

Exploitation requires a valid low-privileged authenticated account on the target WordPress site (CVSS PR:L) plus a user-interaction step (UI:R), and the site must run WP VR from an unspecified early version through 9.1.3. The core condition is the plugin's missing authorization check on a privileged function, allowing an under-privileged user to invoke it. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated (an account/foothold is needed), exploitation depends on the required interaction completing, and impact is bounded to Low confidentiality/integrity/availability. No special non-default configuration is called out in the description.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP VR WordPress plugin, rated CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L) AND user interaction (UI:R), with limited (Low) impact across confidentiality, integrity, and availability despite a changed scope. No EPSS score, KEV listing, POC, or SSVC data was supplied in the input. Per precision rules this is therefore 'no public exploit identified at time of analysis' - exploitation is neither confirmed in the wild (not in CISA KEV) nor backed by published exploit code. The combination of required authentication, required user interaction, and only Low impacts makes this a real-but-non-urgent issue rather than a drop-everything priority: it is a credible privilege/access-control weakness on affected sites but lacks the mass-exploitation signals (high EPSS, KEV, public POC) that would elevate it. Note a terminology conflict in the metadata - the source tags label this 'Authentication Bypass', but the CWE (862) and description describe broken/missing access control, which is distinct; this does not change severity but should be noted when cross-referencing.

A low-privileged authenticated user (e.g., a subscriber or contributor account) on a site running WP VR ≤9.1.3 sends a request to a plugin function that fails to verify the caller's authorization, and - combined with a required user-interaction step - performs an action or accesses data reserved for higher-privileged roles. No public exploit code was identified in the provided data, so any current exploitation would require an attacker to independently develop the request against the vulnerable endpoint.