{"id":"CVE-2026-119033","kind":"vulnerability","aliases":["CVE-2026-119033"],"related":[],"title":"WordPress Schema & Structured Data plugin lets contributors alter other users' post data","description":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","summary":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether a user may edit a post before changing its structured data settings. A Contributor or higher user, once an administrator has granted them plugin access, can disable, alter or reset the structured data of posts they do not own.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["no-plugin-access-granted-to-contributors","version-1.70-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; versions below `1.70` are in scope.\n- Review which users hold the Contributor role or higher and whether an administrator granted them access to the plugin's settings.","fix":"- Schema & Structured Data for WP & AMP: move to `1.70` or later.","status":"open","published_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:41+00:00","updated_at":"2026-11-11T06:27:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:41Z","model":"claude-haiku-5-5","output":{"fix":"- Schema & Structured Data for WP & AMP: move to `1.70` or later.","reach":"network","title":"WordPress Schema & Structured Data plugin lets contributors alter other users' post data","impact":"low","summary":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check whether a user may edit a post before changing its structured data settings. A Contributor or higher user, once an administrator has granted them plugin access, can disable, alter or reset the structured data of posts they do not own.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Contributors alter or reset structured data of posts they do not own","analyst_note":"Product ranges were not supplied; the fixed version 1.70 comes from the description alone.\n","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; versions below `1.70` are in scope.\n- Review which users hold the Contributor role or higher and whether an administrator granted them access to the plugin's settings.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.70-or-later","no-plugin-access-granted-to-contributors"],"who_is_affected":"Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where Contributor-or-higher accounts have been granted plugin access. The flaw is an authorization gap on post structured data, so sites that do not grant plugin access to these roles are less exposed. Sites on version 1.70 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00076,"input_tokens":4583,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119033':15A,18A '-2026':14A,17A '1.70':34B,84C,131C 'access':63B,119C 'administr':58B,115C 'allow':105C 'alter':8A,66B,134C 'amp':30B,80C,127C 'chang':46B,98C 'check':37B 'contributor':7A,52B,109C 'cve':13A,16A 'data':4A,12A,27B,49B,71B,77C,103C,124C,139C 'disabl':65B,133C 'edit':42B,92C 'grant':60B,117C 'higher':54B 'host':22B 'let':6A,96C 'may':41B,91C 'packag':19B 'plugin':5A,32B,62B,82C,129C 'post':11A,44B,73B,94C,100C,141C 'reset':68B,136C 'role':110C 'schema':2A,25B,75C,122C 'self':21B 'self-host':20B 'set':50B,104C 'structur':3A,26B,48B,70B,76C,102C,123C,138C 'user':10A,40B,55B,90C,106C 'verifi':87C 'whether':38B 'wordpress':1A,23B,31B,81C,128C 'wp':29B,79C,126C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 where Contributor-or-higher accounts have been granted plugin access. The flaw is an authorization gap on post structured data, so sites that do not grant plugin access to these roles are less exposed. Sites on version 1.70 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119033':15A,18A '-2026':14A,17A 'alter':8A 'contributor':7A 'cve':13A,16A 'data':4A,12A 'let':6A 'plugin':5A 'post':11A 'schema':2A 'structur':3A 'user':10A 'wordpress':1A","search_b":"'1.70':34B 'access':63B 'administr':58B 'alter':66B 'amp':30B 'chang':46B 'check':37B 'contributor':52B 'data':27B,49B,71B 'disabl':65B 'edit':42B 'grant':60B 'higher':54B 'host':22B 'may':41B 'packag':19B 'plugin':32B,62B 'post':44B,73B 'reset':68B 'schema':25B 'self':21B 'self-host':20B 'set':50B 'structur':26B,48B,70B 'user':40B,55B 'whether':38B 'wordpress':23B,31B 'wp':29B","search_c":"'1.70':84C,131C 'access':119C 'administr':115C 'allow':105C 'alter':134C 'amp':80C,127C 'chang':98C 'contributor':109C 'data':77C,103C,124C,139C 'disabl':133C 'edit':92C 'grant':117C 'let':96C 'may':91C 'plugin':82C,129C 'post':94C,100C,141C 'reset':136C 'role':110C 'schema':75C,122C 'set':104C 'structur':76C,102C,123C,138C 'user':90C,106C 'verifi':87C 'wordpress':81C,128C 'wp':79C,126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119033","severity":null,"published_at":"2026-11-11T06:17:15+00:00","modified_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}