CVE-2026-119033: Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR

Q: Which users can exploit this issue?

A user with the Contributor role or higher can exploit it if an administrator has granted that user access to the plugin. The issue affects their ability to modify structured data on posts they do not own.

Q: Does exploitation require access beyond a normal WordPress account?

Yes. The attacker needs an authenticated WordPress account with at least the Contributor role and access to the Schema & Structured Data for WP & AMP plugin granted by an administrator.

Q: What changes could an attacker make to another user's post?

They can disable, alter, or reset the structured data settings for posts they do not own.

Q: How can I determine whether my site is affected?

Check whether Schema & Structured Data for WP & AMP is installed at a version earlier than 1.70, and identify Contributor-or-higher users who have been granted access to the plugin.

Published Nov 11, 2026

Updated

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.

Affected Software

1 affected component

Schema & Structured Data for WP & AMP<1.70

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Schema & Structured Data for WP & AMP to a version that resolves this vulnerability.
Fixed in 1.70

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

A user with the Contributor role or higher can exploit it if an administrator has granted that user access to the plugin. The issue affects their ability to modify structured data on posts they do not own.

Does exploitation require access beyond a normal WordPress account?

Yes. The attacker needs an authenticated WordPress account with at least the Contributor role and access to the Schema & Structured Data for WP & AMP plugin granted by an administrator.

What changes could an attacker make to another user's post?

They can disable, alter, or reset the structured data settings for posts they do not own.

How can I determine whether my site is affected?

Check whether Schema & Structured Data for WP & AMP is installed at a version earlier than 1.70, and identify Contributor-or-higher users who have been granted access to the plugin.

CVE-2026-119033: Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require access beyond a normal WordPress account?

What changes could an attacker make to another user's post?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require access beyond a normal WordPress account?

What changes could an attacker make to another user's post?

How can I determine whether my site is affected?