Description
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Schema & Structured Data for WP & AMP | < 1.70 | 1.70 |
References
- https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71/ exploit vdb-entry technical-description