CVSS 5.3 (medium) · published 2026-11-11
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.
Weakness: CWE-862
Source: NVD CVE-2026-119032
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.