CVE-2026-119034: Schema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review Filter

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or authorization to view the affected post is required.

Q: What information may be exposed?

The issue exposes approved comments associated with private, draft, and password-protected posts. It may also allow retrieval of approved comments across the site.

Q: Are only publicly visible posts affected?

No. The vulnerable review feature returns approved comments without confirming that the underlying post is publicly viewable, affecting non-public post states including private, draft, and password-protected posts.

Q: Which plugin versions are affected?

Schema & Structured Data for WP & AMP versions before 1.70 are affected.

Published Nov 11, 2026

Updated

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.

Affected Software

1 affected component

Schema & Structured Data for WP & AMP<1.70

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or authorization to view the affected post is required.

What information may be exposed?

The issue exposes approved comments associated with private, draft, and password-protected posts. It may also allow retrieval of approved comments across the site.

Are only publicly visible posts affected?

No. The vulnerable review feature returns approved comments without confirming that the underlying post is publicly viewable, affecting non-public post states including private, draft, and password-protected posts.

Which plugin versions are affected?

Schema & Structured Data for WP & AMP versions before 1.70 are affected.

CVE-2026-119034: Schema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review Filter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Are only publicly visible posts affected?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Are only publicly visible posts affected?

Which plugin versions are affected?