EUVD-2026-35988
GHSA-cwcg-79p4-f24h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Articles & Coverage 2
AnalysisAI
Unauthenticated arbitrary file upload in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60 allows remote attackers to upload any file type accepted by WordPress's media library through frontend AJAX handlers intended for images and videos only. The plugin fails to perform user capability checks and does not validate uploaded file content against the endpoint's declared media type. Publicly available exploit code exists via WPScan, increasing the urgency for immediate patching despite no confirmed in-the-wild exploitation.
Technical ContextAI
The Schema & Structured Data for WP & AMP plugin extends WordPress with schema.org structured data for SEO and AMP compatibility, exposing frontend AJAX endpoints (wp-admin/admin-ajax.php actions) to support media uploads tied to schema markup. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), compounded by a missing authorization layer - the affected AJAX file-upload handlers neither verify the caller's WordPress capability (e.g., via current_user_can() or check_ajax_referer with nonce validation) nor inspect the MIME/content of submitted files against the endpoint's intended image or video constraint. As a result, the plugin relies solely on WordPress's media library's broader allowed-MIME allowlist, which can include types attackers can abuse for code execution or persistence in misconfigured environments. The CPE string cpe:2.3:a:unknown:schema_&_structured_data_for_wp_&_amp covers all versions prior to 1.60.
RemediationAI
Vendor-released patch: upgrade the Schema & Structured Data for WP & AMP plugin to version 1.60 or later, which addresses both the missing capability check and the content-type validation gap per the WPScan advisory (https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/). If immediate patching is not feasible, compensating controls include deactivating the plugin entirely (which removes schema markup and may impact SEO), blocking the plugin's frontend AJAX action names at a WAF or via mu-plugin filter on admin-ajax.php for unauthenticated requests (which may break legitimate frontend schema-related submissions), and tightening WordPress's allowed upload MIME types via the upload_mimes filter to restrict the media library allowlist (which may break uploads in other plugins that rely on broader types). Also audit wp-content/uploads for unexpected file types and review web server configuration to ensure the uploads directory cannot execute PHP or other server-side code.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema &
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cust
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today