Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR
Summary
| CVE | CVE-2026-119033 |
|---|---|
| State | PUBLISHED |
| Assigner | WPScan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 06:17:15 UTC |
| Updated | 2026-11-11 06:17:15 UTC |
| Description | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own. |
Risk And Classification
Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Unknown | Schema Structured Data For WP AMP | affected 1.70 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71 | [email protected] | wpscan.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Muni Nitish Kumar Yaddala (en)
CNA: WPScan (en)
There are currently no legacy QID mappings associated with this CVE.