WordPress Plugin Vulnerabilities

Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

Description

The plugin does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.

Proof of Concept

Affects Plugins

Plugin icon
schema-and-structured-data-for-wp
Fixed in 1.66

References

CVE
CVE-2026-82126

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Shirshak
Submitter
Shirshak
Verified
Yes
WPVDB ID
c6476bdd-1360-449f-b7be-6c532efe9de9

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2024-05-21
Title
UserPro < 5.1.9 - Unauthenticated Account Takeover to Privilege Escalation
Published
2026-07-24
Title
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
Published
2021-01-29
Title
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
Published
2026-07-28
Title
YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
Published
2026-07-27
Title
User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled