WordPress Plugin Vulnerabilities

Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

Description

The plugin does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.

Proof of Concept

Affects Plugins

Plugin icon
schema-and-structured-data-for-wp
Fixed in 1.66

References

CVE
CVE-2026-82125

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
1ed1a2a1-e23d-4c4c-a933-f55b3e14ad09

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-02-03
Title
JS Help Desk – The Ultimate Help Desk & Support Plugin < 2.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-03-29
Title
Thumbs Rating <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
Published
2025-11-11
Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.140 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Published
2026-08-31
Title
MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
Published
2026-09-10
Title
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.6 - Unauthenticated Insecure Direct Object Reference