Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-119032 EUVD-2026-123177GHSA-8wcg-mf5g-pxjv

Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

Published Nov 11, 2026 · Updated Nov 11, 2026 · Assigned by WPScan

Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.

Affected products

VendorProductAffectedFixed
— Schema & Structured Data for WP & AMP < 1.70 1.70

References