CVE-2026-82124

Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.

Affected

Schema & Structured Data for WP & AMP

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 27th percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/16c65787-c43a-42c6-94b8-5f748a1b0b25/

References

• CVE Record
• NVD entry