CVE-2026-82124: medium-severity vulnerability in Schema & Structured Data for WP & AMP
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Schema & Structured Data for WP & AMPpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/16c65787-c43a-42c6-94b8-5f748a1b0b25/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Schema & Structured Data for WP & AMP
In the same product, most dangerous first.
CVE-2026-9067CRITICALSchema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media UploadEPSS 0.6%CVE-2026-82125MEDIUMSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOREPSS 0.3%CVE-2026-82126LOWSchema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema GenerationEPSS 0.3%CVE-2025-9512MEDIUMSchema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSSEPSS 0.3%CVE-2026-82127LOWSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term FieldsEPSS 0.1%CVE-2026-119035MEDIUMSchema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty PrintEPSS —