{"id":"CVE-2026-119034","kind":"vulnerability","aliases":["CVE-2026-119034"],"related":[],"title":"WordPress Schema & Structured Data plugin leaks private post comments to anyone","description":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.","summary":"The Schema & Structured Data for WP & AMP plugin before 1.70 returns approved comments from private, draft and password-protected posts through its review feature without checking whether the post is public. An unauthenticated attacker can read those comments and retrieve approved comments across the whole site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","schema-and-structured-data-for-wp","self-hosted","wordpress"],"not_affected_if":["plugin-1.70-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the 'Schema & Structured Data for WP & AMP' plugin in the WordPress admin under Plugins, or run `wp plugin get schema-and-structured-data-for-wp --field=version` if WP-CLI is available.\n- Compare against the fixed version named in the sources: the plugin must be at `1.70` or later.","fix":"- Schema & Structured Data for WP & AMP: move to `1.70` or later (the sources state the plugin is fixed before 1.70 is the vulnerable range).","status":"open","published_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:38+00:00","updated_at":"2026-11-11T06:27:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:38Z","model":"claude-haiku-5-5","output":{"fix":"- Schema & Structured Data for WP & AMP: move to `1.70` or later (the sources state the plugin is fixed before 1.70 is the vulnerable range).","reach":"internet","title":"WordPress Schema & Structured Data plugin leaks private post comments to anyone","impact":"low","summary":"The Schema & Structured Data for WP & AMP plugin before 1.70 returns approved comments from private, draft and password-protected posts through its review feature without checking whether the post is public. An unauthenticated attacker can read those comments and retrieve approved comments across the whole site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","schema-and-structured-data-for-wp"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read approved comments from private and draft posts.","analyst_note":"","how_to_check":"- Check the installed version of the 'Schema & Structured Data for WP & AMP' plugin in the WordPress admin under Plugins, or run `wp plugin get schema-and-structured-data-for-wp --field=version` if WP-CLI is available.\n- Compare against the fixed version named in the sources: the plugin must be at `1.70` or later.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.70-or-later"],"who_is_affected":"WordPress sites running the Schema & Structured Data for WP & AMP plugin older than 1.70 that use its review feature. The flaw exposes approved comments on posts that are not publicly viewable, so sites that do not run this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4554,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119034':14A,17A '-2026':13A,16A '1.70':39B,87C 'across':73B 'allow':106C 'amp':36B,83C 'anyon':11A 'approv':41B,71B,100C,111C,124C 'attack':64B,108C 'check':56B 'comment':9A,42B,68B,72B,101C,112C,125C 'cve':12A,15A 'data':4A,23B,33B,80C 'draft':45B,115C 'featur':54B,105C 'host':28B 'leak':6A 'packag':18B 'password':48B,118C 'password-protect':47B,117C 'plugin':5A,37B,85C 'post':8A,50B,59B,93C,120C 'privat':7A,44B,114C 'protect':49B,119C 'public':61B,95C 'read':66B,110C 'retriev':70B,123C 'return':40B,98C 'review':53B,104C 'schema':2A,20B,31B,78C 'schema-and-structured-data-for-wp':19B 'self':27B 'self-host':26B 'site':76B,127C 'site-wid':126C 'structur':3A,22B,32B,79C 'unauthent':63B,107C 'verifi':90C 'viewabl':96C 'whether':57B 'whole':75B 'wide':128C 'without':55B 'wordpress':1A,29B,84C 'wp':25B,35B,82C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Schema & Structured Data for WP & AMP plugin older than 1.70 that use its review feature. The flaw exposes approved comments on posts that are not publicly viewable, so sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","schemaandstructureddataforwp","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119034':14A,17A '-2026':13A,16A 'anyon':11A 'comment':9A 'cve':12A,15A 'data':4A 'leak':6A 'plugin':5A 'post':8A 'privat':7A 'schema':2A 'structur':3A 'wordpress':1A","search_b":"'1.70':39B 'across':73B 'amp':36B 'approv':41B,71B 'attack':64B 'check':56B 'comment':42B,68B,72B 'data':23B,33B 'draft':45B 'featur':54B 'host':28B 'packag':18B 'password':48B 'password-protect':47B 'plugin':37B 'post':50B,59B 'privat':44B 'protect':49B 'public':61B 'read':66B 'retriev':70B 'return':40B 'review':53B 'schema':20B,31B 'schema-and-structured-data-for-wp':19B 'self':27B 'self-host':26B 'site':76B 'structur':22B,32B 'unauthent':63B 'whether':57B 'whole':75B 'without':55B 'wordpress':29B 'wp':25B,35B","search_c":"'1.70':87C 'allow':106C 'amp':83C 'approv':100C,111C,124C 'attack':108C 'comment':101C,112C,125C 'data':80C 'draft':115C 'featur':105C 'password':118C 'password-protect':117C 'plugin':85C 'post':93C,120C 'privat':114C 'protect':119C 'public':95C 'read':110C 'retriev':123C 'return':98C 'review':104C 'schema':78C 'site':127C 'site-wid':126C 'structur':79C 'unauthent':107C 'verifi':90C 'viewabl':96C 'wide':128C 'wordpress':84C 'wp':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119034","severity":null,"published_at":"2026-11-11T06:17:15+00:00","modified_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}