CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-16

Last modified

2026-09-17

Weaknesses

CWE-200

Affected products

• Schema Structured Data For Wp Amp (Unknown)

References

• https://wpscan.com/vulnerability/16c65787-c43a-42c6-94b8-5f748a1b0b25/