{"id":"CVE-2026-119032","kind":"vulnerability","aliases":["CVE-2026-119032"],"related":[],"title":"WordPress Schema plugin: settings import lets users edit any post","description":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","summary":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether the importing user may edit the posts named in a settings backup. A user granted access to the plugin's settings can therefore modify, unpublish or trash any post or page and write arbitrary post meta.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Schema & Structured Data for WP & AMP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","schema-markup","wordpress","wordpress-plugin"],"not_affected_if":["plugin-at-1.70-or-later","settings-limited-to-administrators"],"how_to_check":"- Check the installed version of the Schema & Structured Data for WP & AMP plugin in the WordPress admin Plugins screen; versions below `1.70` are affected.\n- Review which roles have been granted access to the plugin's settings.","fix":"- Update the Schema & Structured Data for WP & AMP plugin to `1.70` or later.","status":"open","published_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:40+00:00","updated_at":"2026-11-11T06:27:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Schema & Structured Data for WP & AMP plugin to `1.70` or later.","reach":"network","title":"WordPress Schema plugin: settings import lets users edit any post","impact":"high","summary":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether the importing user may edit the posts named in a settings backup. A user granted access to the plugin's settings can therefore modify, unpublish or trash any post or page and write arbitrary post meta.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","schema-markup"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege user edits or deletes any site post","analyst_note":"","how_to_check":"- Check the installed version of the Schema & Structured Data for WP & AMP plugin in the WordPress admin Plugins screen; versions below `1.70` are affected.\n- Review which roles have been granted access to the plugin's settings.","plain_action":"","product_name":"Schema & Structured Data for WP & AMP","needs_analyst":false,"not_affected_if":["plugin-at-1.70-or-later","settings-limited-to-administrators"],"who_is_affected":"Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where non-administrator users have been granted access to its settings. Sites without the plugin, or where only full administrators can reach its settings, are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4594,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119032':13A,16A '-2026':12A,15A '1.70':41B,92C,138C 'access':61B,126C 'administr':123C 'allow':118C 'amp':22A,37B,88C,134C 'arbitrari':79B,158C 'author':145C 'backup':57B,108C 'check':44B,95C 'cve':11A,14A 'data':19A,34B,85C,131C 'edit':8A,50B,101C 'for':20A 'grant':60B,125C 'import':5A,47B,98C,112C 'let':6A 'markup':26B 'may':49B,100C 'meta':81B,160C 'modifi':69B,142C 'name':53B,104C 'packag':23B 'page':76B,152C 'plugin':3A,30B,39B,64B,90C,136C 'post':10A,52B,74B,80B,103C,116C,150C,159C 're':144C 're-author':143C 'restrict':110C 'role':121C 'schema':2A,17A,25B,32B,83C,129C 'schema-markup':24B 'set':4A,56B,66B,107C,140C 'site':155C 'structur':33B,84C,130C 'structured':18A 'therefor':68B 'trash':72B,148C 'type':117C 'unpublish':70B,146C 'user':7A,48B,59B,99C,119C 'whether':45B 'whose':120C 'wordpress':1A,27B,29B,38B,89C,135C 'wordpress-plugin':28B 'wp':21A,36B,87C,133C 'write':78B,157C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where non-administrator users have been granted access to its settings. Sites without the plugin, or where only full administrators can reach its settings, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["schemastructureddataforwpamp","structureddataforwpamp"],"ptokens":["amp","data","for","schema","structured","wp"],"labels":["medium","package","schemamarkup","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-119032':13A,16A '-2026':12A,15A 'amp':22A 'cve':11A,14A 'data':19A 'edit':8A 'for':20A 'import':5A 'let':6A 'plugin':3A 'post':10A 'schema':2A,17A 'set':4A 'structured':18A 'user':7A 'wordpress':1A 'wp':21A","search_b":"'1.70':41B 'access':61B 'amp':37B 'arbitrari':79B 'backup':57B 'check':44B 'data':34B 'edit':50B 'grant':60B 'import':47B 'markup':26B 'may':49B 'meta':81B 'modifi':69B 'name':53B 'packag':23B 'page':76B 'plugin':30B,39B,64B 'post':52B,74B,80B 'schema':25B,32B 'schema-markup':24B 'set':56B,66B 'structur':33B 'therefor':68B 'trash':72B 'unpublish':70B 'user':48B,59B 'whether':45B 'wordpress':27B,29B,38B 'wordpress-plugin':28B 'wp':36B 'write':78B","search_c":"'1.70':92C,138C 'access':126C 'administr':123C 'allow':118C 'amp':88C,134C 'arbitrari':158C 'author':145C 'backup':108C 'check':95C 'data':85C,131C 'edit':101C 'grant':125C 'import':98C,112C 'may':100C 'meta':160C 'modifi':142C 'name':104C 'page':152C 'plugin':90C,136C 'post':103C,116C,150C,159C 're':144C 're-author':143C 'restrict':110C 'role':121C 'schema':83C,129C 'set':107C,140C 'site':155C 'structur':84C,130C 'trash':148C 'type':117C 'unpublish':146C 'user':99C,119C 'whose':120C 'wordpress':89C,135C 'wp':87C,133C 'write':157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119032","severity":null,"published_at":"2026-11-11T06:17:15+00:00","modified_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}