CVE-2026-82126: CWE-284 Improper Access Control in Schema & Structured Data for WP & AMP
The Schema & Structured Data for WP & AMP WordPress plugin versions 1.63 up to but not including 1.66 contains an improper access control vulnerability. This flaw allows users with the contributor role and above to access content of other users' draft, pending, private, and password-protected posts without proper authorization checks.
AI Analysis
Technical Summary
CVE-2026-82126 is an improper access control vulnerability (CWE-284) in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.66. The plugin fails to verify whether a user is authorized to edit a specific post when generating schema data, enabling users with contributor or higher roles to retrieve content from other users' non-public posts, including drafts, pending, private, and password-protected posts.
Potential Impact
Users with contributor role or higher can access sensitive content from other users' posts that are not publicly available, potentially leading to unauthorized disclosure of unpublished or protected content.
Mitigation Recommendations
Upgrade the Schema & Structured Data for WP & AMP plugin to version 1.66 or later where this access control issue is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-82126: CWE-284 Improper Access Control in Schema & Structured Data for WP & AMP
Description
The Schema & Structured Data for WP & AMP WordPress plugin versions 1.63 up to but not including 1.66 contains an improper access control vulnerability. This flaw allows users with the contributor role and above to access content of other users' draft, pending, private, and password-protected posts without proper authorization checks.
Affected software
Schema & Structured Data for WP & AMP
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82126 is an improper access control vulnerability (CWE-284) in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.66. The plugin fails to verify whether a user is authorized to edit a specific post when generating schema data, enabling users with contributor or higher roles to retrieve content from other users' non-public posts, including drafts, pending, private, and password-protected posts.
Potential Impact
Users with contributor role or higher can access sensitive content from other users' posts that are not publicly available, potentially leading to unauthorized disclosure of unpublished or protected content.
Mitigation Recommendations
Upgrade the Schema & Structured Data for WP & AMP plugin to version 1.66 or later where this access control issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-28T07:01:55.400Z
- State
- PUBLISHED
Threat ID: 6aaa32e055bf5e2cf517fb2e
Added to database: 09/16/2026, 06:10:40 UTC
Last enriched: 09/16/2026, 06:31:48 UTC
Last updated: 09/16/2026, 14:21:47 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.