Schema Structured Data CVE-2026-82125

No special conditions - remote unauthenticated exploitation against default configurations of the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.46 up to but not including 1.66). Exploitation only requires that the site run a vulnerable plugin version and that comments awaiting moderation or marked as spam exist to be read; no authentication, user interaction, or non-default settings are needed. The practical limit on impact is the data itself: only comment text (pending or spam) is exposed - no credentials, post/write access, or administrative capability - so severity stays low (C:L only).

This is a genuine but low-severity information-disclosure flaw, correctly scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - network-reachable, no privileges, no user interaction, but confidentiality-only with limited impact (C:L, I:N, A:N). CWE-639 (IDOR / authorization bypass through user-controlled key) matches the root cause: the plugin returns comment content without verifying ownership or moderation status. Signals are consistent and non-alarming: EPSS is 0.18% (8th percentile), it is NOT on CISA KEV, and while a POC exists via WPScan, POC availability is a distinct signal from active exploitation. The realistic impact is bounded - an attacker learns the text of pending/spam comments (potential PII or private feedback), not credentials, admin access, or write capability. Priority: LOW-to-MODERATE for defenders; patch during normal maintenance rather than as an emergency, but the unauthenticated network vector plus public POC means it can be trivially automated against unpatched sites, so do not defer indefinitely.

An unauthenticated attacker sends a crafted request to a vulnerable site's plugin endpoint referencing a comment identifier, and the plugin returns the comment's content without checking whether it is approved, spam, or owned by the requester. Because publicly available exploit code exists (WPScan) and no authentication or user interaction is required (PR:N/UI:N), the attacker can enumerate identifiers to harvest the text of comments still awaiting moderation or flagged as spam.