CVE-2026-119033 · Package
NO FIX YET · SEE WHAT TO DO
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether a user may edit a post before changing its structured data settings. A Contributor or higher user, once an administrator has granted them plugin access, can disable, alter or reset the structured data of posts they do not own.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where Contributor-or-higher accounts have been granted plugin access. The flaw is an authorization gap on post structured data, so sites that do not grant plugin access to these roles are less exposed. Sites on version 1.70 or later are not affected.
Not affected if no-plugin-access-granted-to-contributors, version-1.70-or-later
Who cares self-hosted, wordpress
1.70 are in scope.1.70 or later.The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.