CVE-2026-82125: CWE-639 Authorization Bypass Through User-Controlled Key in Schema & Structured Data for WP & AMP
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
AI Analysis
Technical Summary
CVE-2026-82125 is an authorization bypass vulnerability in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.66. The plugin fails to properly verify whether a comment is owned by the requesting user or its moderation status before returning its content. Consequently, unauthenticated users can read comments that have not yet been approved or are flagged as spam, potentially exposing sensitive or private information.
Potential Impact
Unauthenticated attackers can access the content of comments that are pending moderation or marked as spam. This could lead to unintended disclosure of information that site administrators intended to keep private until approval or removal. There is no indication of further impact such as code execution or privilege escalation.
Mitigation Recommendations
Users should upgrade the Schema & Structured Data for WP & AMP plugin to version 1.66 or later, where this vulnerability is fixed. Since the vulnerability is addressed in version 1.66, applying this update will remediate the issue. No other mitigations are indicated.
CVE-2026-82125: CWE-639 Authorization Bypass Through User-Controlled Key in Schema & Structured Data for WP & AMP
Description
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
Affected software
Schema & Structured Data for WP & AMP
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82125 is an authorization bypass vulnerability in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.66. The plugin fails to properly verify whether a comment is owned by the requesting user or its moderation status before returning its content. Consequently, unauthenticated users can read comments that have not yet been approved or are flagged as spam, potentially exposing sensitive or private information.
Potential Impact
Unauthenticated attackers can access the content of comments that are pending moderation or marked as spam. This could lead to unintended disclosure of information that site administrators intended to keep private until approval or removal. There is no indication of further impact such as code execution or privilege escalation.
Mitigation Recommendations
Users should upgrade the Schema & Structured Data for WP & AMP plugin to version 1.66 or later, where this vulnerability is fixed. Since the vulnerability is addressed in version 1.66, applying this update will remediate the issue. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-28T07:01:49.985Z
- State
- PUBLISHED
Threat ID: 6aaa32e055bf5e2cf517fb2c
Added to database: 09/16/2026, 06:10:40 UTC
Last enriched: 09/16/2026, 06:31:54 UTC
Last updated: 09/16/2026, 22:11:12 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.