CVE-2026-82125: Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR
Published Sep 16, 2026
·Updated
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
Event History
Sep 16, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated user can exploit it. No login or comment ownership is required to retrieve affected comment content.
2
Which comments may be exposed?
Comments awaiting moderation and comments marked as spam may be disclosed. The issue occurs because the plugin does not properly verify comment ownership or moderation status before returning content.
3
Which plugin versions are affected?
Schema & Structured Data for WP & AMP versions before 1.66 are affected, including versions 1.46 through 1.65.