Schema & Structured Data CVE-2026-82126

Requires an authenticated account with the WordPress contributor role or higher on a site running Schema & Structured Data for WP & AMP versions 1.63 through 1.65. The attacker invokes the plugin's schema-generation function against a post ID they do not own; the function fails to verify the requester has edit rights to that specific post. Exploitation is limited to sites that grant contributor (or higher) accounts to untrusted or semi-trusted users - typical of multi-author blogs, guest-post workflows, or open-registration sites configured to assign contributor roles. Impact is confidentiality-only: it discloses the CONTENT of other users' draft, pending, private, and password-protected posts, but does not allow modification. No user interaction by a victim is required.

This is a genuine but low-severity information-disclosure flaw, not a top-priority issue. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, vendor score 2.7) reflects confidentiality-only impact with no integrity or availability effect. There is a notable internal conflict: the vector encodes PR:H (high privileges), yet the description states the flaw is exploitable by 'contributor role and above' - contributor is one of WordPress's LOWEST-privileged authoring roles, so PR:L is the more defensible choice, which would raise the score to roughly 4.3. This under-scores the barrier: any authenticated contributor, not an admin, can read other users' unpublished and protected content. Exploitation signals are modest: EPSS is 0.17% (7th percentile), the CVE is NOT in CISA KEV, and there is no evidence of active exploitation - but public exploit code exists (WPScan). The realistic risk is a low-privileged insider or a registered contributor on a multi-author site harvesting drafts, private posts, and password-protected content they should not see. Given a patch is available (1.66) and impact is confidentiality-only, this is a routine-priority patch, not an emergency, but multi-author sites that grant contributor accounts should treat it as meaningful.

An attacker registers or already holds a contributor account on a multi-author WordPress site running the plugin below 1.66. They invoke the schema-generation route for post IDs they do not own - which skips the per-post edit-capability check - and read back the content of other users' draft, pending, private, and password-protected posts. Public exploit code is available via WPScan, making the request trivial to reproduce.