Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-82124: Schema & Structured Data for WP & AMP leaks protected posts
CVE-2026-82124 · published 1 month ago
Summary
The Schema & Structured Data for WP & AMP plugin for WordPress, versions before 1.66, adds the full text of password‑protected posts to the extra data it creates for search engines. Because it does not check the protection, any visitor can see the hidden content through that data. Upgrade to version 1.66 or later (or remove the plugin) to stop the exposure.
What to do
- Update unknown schema & structured data for wp & amp to version 1.66 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | schema & structured data for wp & amp | < 1.66 |
Original advisory text
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-200Information Exposure
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Track software like this
Free during beta