Schema & Structured Data CVE-2026-82124

No special conditions beyond the plugin being installed and active at a version before 1.66 (Schema & Structured Data for WP & AMP): remote unauthenticated exploitation works against default configurations. The practical limiting factor is content-dependent - the site must actually use WordPress password-protected posts, and there must be protected content worth disclosing; on sites that do not use post passwords there is nothing to leak. No authentication, no user interaction, and no non-default setting are required, and the plugin exposes the flaw via more than one public output route, so mitigations that block a single endpoint are insufficient short of upgrading to 1.66.

This is a genuine but low-to-moderate severity information-disclosure issue, not a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) is internally consistent with the description: unauthenticated network attackers can retrieve password-protected post content with no special conditions, but impact is confined to confidentiality of a single content class (C:L, no integrity or availability impact). EPSS is low at 0.19% (9th percentile), and there is no CISA KEV listing, indicating no known active exploitation and no signal of mass automated attacks - consistent with a niche disclosure bug rather than a wormable RCE. However, publicly available exploit code exists (WPScan), which lowers the skill barrier and means opportunistic exploitation against sites that gate content behind post passwords is plausible. Net: a real, patch-worthy priority for sites that actually rely on WordPress password-protected posts to withhold content, but not a broad emergency for the typical install where post passwords are unused. No key signals are missing or conflicting - the CVSS vector, description, POC status and EPSS all agree that this is a moderate confidentiality-only flaw.

An attacker who knows or discovers the URL/ID of a password-protected post on a site running this plugin requests the page's structured-data (JSON-LD) output - or another public schema output route - without supplying the post password, and the plugin embeds the protected post body directly into the schema markup. Because a working technique is publicly documented by WPScan, this requires no authentication, no user interaction, and only a crafted public request. The result is disclosure of content the site owner intended to keep behind a password.