CVE-2025-12005

MEDIUM

WP VR - 360 Panorama & Free Virtual Tour Builder For WordPress <8.5...

Title source: llm

Description

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.

References (3)

Core 3

Core References

Product

https://plugins.trac.wordpress.org/browser/wpvr/tags/8.5.41/admin/class-wpvr-admin.php#L295

Product

https://plugins.trac.wordpress.org/browser/wpvr/tags/8.5.41/admin/classes/class-wpvr-ajax.php#L467

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcbc0cf-69e5-4d6e-8987-a0fbbaf41740?source=cve

Scores

CVSS v3 4.3

EPSS 0.0020

EPSS Percentile 10.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-285

Status published

Products (1)

rextheme/WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress < 8.5.41

Published Oct 25, 2025

Tracked Since Feb 18, 2026