{"id":"CVE-2026-119032","aliases":["EUVD-2026-123177","GHSA-8wcg-mf5g-pxjv"],"status":"published","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Authenticated Arbitrary Post Modification via Backup Import","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-14","score":0.00247,"percentile":0.16108,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-11T06:00:09Z","modified":"2026-11-11T12:32:43Z","products":[{"vendor":"magazine3","product":"schema \u0026 structured data for wp \u0026 amp"},{"vendor":"unknown","product":"schema \u0026 structured data for wp \u0026 amp"}],"references":[{"url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119032"},{"url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18"},{"url":"https://github.com/advisories/GHSA-8wcg-mf5g-pxjv"}],"sources":{"cve":[{"id":"CVE-2026-119032","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Authenticated Arbitrary Post Modification via Backup Import","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","status":"published","published":"2026-11-11T06:00:09.2Z","modified":"2026-11-11T11:39:34.952Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123177","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","status":"published","published":"2026-11-11T06:00:09Z","modified":"2026-11-11T11:39:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-11T13:28:47.336858Z"}],"ghsa":[{"id":"GHSA-8wcg-mf5g-pxjv","title":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the...","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","status":"published","published":"2026-11-11T06:32:41Z","modified":"2026-11-11T12:32:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-119032","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","status":"published","published":"2026-11-11T06:17:15.517Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}