CVE-2026-82126CWE-284broken-access-control

CVE-2026-82126

Low · published September 16, 2026

CVSS v3.1

2.7

EPSS

Percentile

21.4

In the wild

Unconfirmed

What it is

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.

The record

Technical detail

CVSS v3.1: 2.7 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00299 · 21.4th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-09-16T10:16Z

References (1)

https://wpscan.com/vulnerability/c6476bdd-1360-449f-b7be-6c532efe9de9/ · [email protected]

EPSS history

Timeline

17 SEP 03:32Z
EPSS moved — → 0%
epss
16 SEP 06:00Z
Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation
cvelistv5