Description
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Schema & Structured Data for WP & AMP | < 1.70 | 1.70 |
References
- https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/ exploit vdb-entry technical-description