CVE-2026-9067criticalCWE-434

CVE-2026-9067: falha crítica em Schema & Structured Data for WP & AMP

Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

Publicada em

Seguir esta CVE+ Monitorar Schema & Structured Data for WP & AMP

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.1epss 0.6%
da publicação à armano mesmo dia
Publicada no NVD10 de jun.
1ª PoC10 de jun.
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Unknown · Schema & Structured Data for WP & AMP
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Schema & Structured Data for WP & AMP

No mesmo produto, das mais perigosas para as menos.

CVE-2026-119034MEDIUMSchema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review FilterEPSS 0.3%CVE-2026-82124MEDIUMSchema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema OutputEPSS 0.3%CVE-2026-119035MEDIUMSchema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty PrintEPSS 0.3%CVE-2026-82125MEDIUMSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOREPSS 0.3%CVE-2026-82126LOWSchema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema GenerationEPSS 0.3%CVE-2025-9512MEDIUMSchema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSSEPSS 0.3%