CVE-2026-82126: Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated WordPress users with the contributor role or higher can exploit it. The issue is relevant where such users can access the plugin's schema-generation functionality.
What content can be exposed?
An affected user may obtain content from other users' draft, pending, private, and password-protected posts. The vulnerability results from missing authorization checks for the specific post requested.
Which plugin versions are affected?
Versions before 1.66 are affected, including versions 1.63 through 1.65. Updating to version 1.66 or later addresses the affected version range.