Schema & Structured Data WordPress Plugin CVE-2026-9067

The vulnerable plugin (Schema & Structured Data for WP & AMP, version < 1.60) must be installed and activated on a network-reachable WordPress site, and the affected frontend AJAX file-upload handlers must be exposed via wp-admin/admin-ajax.php (the default WordPress behavior, which permits unauthenticated invocation of registered wp_ajax_nopriv_* actions). No authentication, user interaction, or special configuration is required - exploitation works against default WordPress installations running the affected plugin version. Real-world impact is bounded by WordPress's media library MIME allowlist (which determines which file types are ultimately accepted) and by web server configuration governing whether files dropped in wp-content/uploads can be executed server-side; sites that have hardened upload-directory execution policies still face content-tampering and hosting-abuse risk but reduce code-execution exposure.

The CVSS 9.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) aligns with real-world risk: network-reachable, low-complexity, no privileges, and no user interaction required, yielding high confidentiality and integrity impact. Publicly available exploit code via WPScan substantially lowers the barrier to mass exploitation, particularly given WordPress's broad attack surface and the historical pattern of plugin file-upload bugs being weaponized in opportunistic scanning campaigns within days of disclosure. EPSS score and CISA KEV listing are not provided in the input, so probability data and confirmed active exploitation cannot be asserted - however, the combination of unauthenticated network vector, public POC, and WordPress plugin ecosystem makes this a high-priority patch regardless of those missing signals. The A:N rating reflects no direct availability impact, but uploaded content could still be leveraged for downstream defacement, malware staging, or pivoting depending on WordPress's MIME allowlist and server-side execution policies.

An unauthenticated attacker scans WordPress sites for the vulnerable plugin and sends a crafted multipart POST request to the frontend AJAX upload endpoint, supplying a file with an extension permitted by WordPress's media library (e.g., a polyglot or otherwise dangerous file masquerading as accepted content) while the endpoint expects only an image or video. Because there is no capability check and no content-type validation, the file lands in wp-content/uploads, where it can be retrieved by URL for malware staging, phishing kit hosting, or - if the server permits execution in the uploads path - code execution. Publicly available exploit details from WPScan reduce time-to-weaponization significantly.