Access Control Flaw in Schema & Structured Data Plugin for WordPress
CVE-2026-119033

Currently unrated

Key Information:

Vendor

WordPress
Status
Schema & Structured Data For WP & Amp
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-119033?

The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 is susceptible to an access control vulnerability. This flaw permits users with the Contributor role and higher, provided they have been granted access to the plugin by an administrator, to modify the structured data settings of posts they do not own. This could lead to unauthorized manipulation of post data, compromising its integrity and misleading search engines or users. Proper verification of user permissions is essential to mitigate this issue.

Affected Version(s)

Schema & Structured Data for WP & AMP 0 < 1.70

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-119033 - Proof of Concept

References

https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.