SCHEMA & STRUCTURED DATA FOR WP & AMP · CVE-2026-119032 · Package
NO FIX YET · SEE WHAT TO DO
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether the importing user may edit the posts named in a settings backup. A user granted access to the plugin's settings can therefore modify, unpublish or trash any post or page and write arbitrary post meta.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where non-administrator users have been granted access to its settings. Sites without the plugin, or where only full administrators can reach its settings, are less exposed.
Not affected if plugin-at-1.70-or-later, settings-limited-to-administrators
Who cares schema-markup, wordpress, wordpress-plugin
1.70 are affected.1.70 or later.The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.