WordPress Plugin Vulnerabilities

Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

Description

The plugin does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.

Proof of Concept

Affects Plugins

Plugin icon
schema-and-structured-data-for-wp
Fixed in 1.66

References

CVE
CVE-2026-82124

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
16c65787-c43a-42c6-94b8-5f748a1b0b25

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-03-11
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.8.2 - Unauthenticated Sensitive Information Exposure
Published
2022-09-29
Title
Media Library Assistant < 3.01 - Unauthenticated Error Log Access
Published
2024-06-20
Title
affiliate-toolkit < 3.4.5 - Unauthenticated Sensitive Information Exposure via Logs
Published
2026-08-10
Title
Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
Published
2025-05-02
Title
Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files