CVE-2026-82124 in Schema & Structured Data for WP & AMP Plugin
Summary
by MITRE • 09/16/2026
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Schema and Structured Data for WP AMP versions prior to 1.66 represents a significant information disclosure flaw rooted in inadequate access control checks within the plugin's data generation logic. This WordPress extension is designed to enhance search engine optimization by generating structured data, such as JSON-LD or microdata, which helps search engines understand page content more effectively. However, the implementation fails to verify whether the current post being processed has password protection enabled before extracting and outputting its textual content into these public-facing structured data formats. This oversight creates a discrepancy between how the main post content is rendered for human visitors versus how it is exposed through automated machine-readable interfaces.
From a technical perspective, WordPress natively handles password-protected posts by masking their content behind an authentication form when accessed via standard HTTP requests to the front end. Users must provide valid credentials to view the actual text of such posts. The vulnerability arises because the plugin's function for generating structured data does not replicate this security gate. Instead, it directly accesses the post object and extracts its content fields without checking the password_protected status flag or verifying user authentication capabilities relative to that specific resource. Consequently, any unauthenticated visitor who knows the URL of a protected post can retrieve its full contents by parsing the HTML source code for structured data blocks or through API endpoints exposed by the plugin's integration with AMP (Accelerated Mobile Pages).
The operational impact of this flaw is substantial, as it effectively bypasses one of WordPress's primary mechanisms for restricting content access. Attackers do not need to exploit complex injection techniques or brute-force passwords; they simply need to inspect the page source or make specific HTTP requests targeting the structured data output routes. This allows unauthorized individuals to read sensitive information that was intended to be private, such as premium articles, confidential announcements, or restricted member-only content. The existence of more than one public output route means that even if a developer attempts to patch one vector, others may remain open unless all entry points for structured data generation are audited and secured simultaneously.
This vulnerability aligns with CWE-200, which categorizes information exposure through error messages or unintended data leakage in publicly accessible areas. It also maps closely to ATT&CK technique T1530, Data from Cloud Storage Object Discovery, as it involves accessing stored data without proper authorization via exposed interfaces. In the context of web applications, this is a classic example of broken access control where the enforcement mechanism for confidentiality is missing or incorrectly implemented in specific subsystems like structured data generators.
To mitigate this risk, administrators should immediately update to version 1.66 or later of the Schema and Structured Data plugin, which includes patches for these access control checks. For organizations unable to upgrade instantly due to compatibility constraints with other plugins or themes, a temporary workaround involves manually disabling the generation of structured data for password-protected posts if the plugin provides such an option in its settings. Additionally, security teams should review their WordPress configurations to ensure that no other plugins are exposing similar unauthenticated access paths to protected content. Regular auditing of third-party code against standard access control patterns is essential to prevent recurrence and maintain the integrity of restricted data flows within the CMS environment.