CVE-2026-82126
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Schema & Structured Data for WP & AMP plugin before 1.66 fails to check user permissions to edit a specific post when generating schema, allowing users with contributor role and above to read other users' draft, pending, private and password-protected posts.
Risk Assessment
An attacker can access non-public content of other users, compromising data confidentiality.
Recommendation
Update the plugin to version 1.66 or later which includes the fix.
Other vulnerabilities in Schema & Structured Data for WP & AMP
See all- CVE-2026-9067Critical
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- CVE-2026-82125Low risk· EPSS 8%
The plugin before 1.66 does not correctly verify comment ownership or moderation status before returning content, allowing unauthenticated users to read comments still awaiting moderation or marked as spam.
- CVE-2026-82124Low risk· EPSS 9%
The plugin before 1.66 does not check if a post is password protected before including its content in structured data, allowing unauthenticated users to obtain password-protected post content through multiple public output routes.
Original NVD description (English source)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.