CVE-2026-119032: Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

Q: Who can exploit this issue?

An authenticated user can exploit it only if an administrator has granted that user's role access to the plugin's settings. The vulnerable import path does not verify whether that user is allowed to edit the posts referenced by the backup.

Q: What impact can a successful exploit have?

A permitted settings user can modify any post or page, change its author, unpublish it, or move it to the trash. They can also write arbitrary post metadata.

Q: Are standard WordPress post types within scope?

Yes. The import is not restricted to the plugin's own post types, so posts and pages elsewhere on the site can be targeted.

Q: What version should be remediated?

Versions before 1.70 are affected. Update the Schema & Structured Data for WP & AMP plugin to version 1.70 or later.

Q: What can be done if updating is not immediately possible?

Review and restrict which roles have access to the plugin's settings, since that access is required to use the vulnerable import functionality. Limit settings access to trusted administrators.

Published Nov 11, 2026

Updated

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.

Affected Software

1 affected component

Magazine3 Schema & Structured Data for WP & AMP<1.70

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Schema & Structured Data for WP & AMP to a version that resolves this vulnerability.
Fixed in 1.70

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit it only if an administrator has granted that user's role access to the plugin's settings. The vulnerable import path does not verify whether that user is allowed to edit the posts referenced by the backup.

What impact can a successful exploit have?

A permitted settings user can modify any post or page, change its author, unpublish it, or move it to the trash. They can also write arbitrary post metadata.

Are standard WordPress post types within scope?

Yes. The import is not restricted to the plugin's own post types, so posts and pages elsewhere on the site can be targeted.

What version should be remediated?

Versions before 1.70 are affected. Update the Schema & Structured Data for WP & AMP plugin to version 1.70 or later.

What can be done if updating is not immediately possible?

Review and restrict which roles have access to the plugin's settings, since that access is required to use the vulnerable import functionality. Limit settings access to trusted administrators.

CVE-2026-119032: Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can a successful exploit have?

Are standard WordPress post types within scope?

What version should be remediated?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can a successful exploit have?

Are standard WordPress post types within scope?

What version should be remediated?

What can be done if updating is not immediately possible?