Information Disclosure in Schema & Structured Data for WP & AMP Plugin
CVE-2026-119034

Currently unrated

Key Information:

Vendor

WordPress
Status
Schema & Structured Data For WP & Amp
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-119034?

The Schema & Structured Data for WP & AMP WordPress plugin does not adequately verify the visibility status of posts before returning their approved comments via the review feature. This oversight permits unauthenticated attackers to access and read approved comments associated with private, draft, and password-protected posts. Consequently, attackers can extract approved comments across the entire site, potentially exposing sensitive information to unauthorized parties.

Affected Version(s)

Schema & Structured Data for WP & AMP 0 < 1.70

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-119034 - Proof of Concept

References

https://wpscan.com/vulnerability/fc30c9de-6c32-4235-abef-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.