{"id":"CVE-2026-119033","aliases":["EUVD-2026-123178","GHSA-3r7q-r5gc-m6xv"],"status":"published","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","severity":{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-14","score":0.00232,"percentile":0.14169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-11-11T06:00:09Z","modified":"2026-11-11T12:32:44Z","products":[{"vendor":"magazine3","product":"schema \u0026 structured data for wp \u0026 amp"},{"vendor":"unknown","product":"schema \u0026 structured data for wp \u0026 amp"}],"references":[{"url":"https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119033"},{"url":"https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71"},{"url":"https://github.com/advisories/GHSA-3r7q-r5gc-m6xv"}],"sources":{"cve":[{"id":"CVE-2026-119033","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","status":"published","published":"2026-11-11T06:00:09.369Z","modified":"2026-11-11T11:39:18.863Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123178","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","status":"published","published":"2026-11-11T06:00:09Z","modified":"2026-11-11T11:39:18Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-11T13:28:47.336858Z"}],"ghsa":[{"id":"GHSA-3r7q-r5gc-m6xv","title":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a...","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","status":"published","published":"2026-11-11T06:32:40Z","modified":"2026-11-11T12:32:44Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-639"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-119033","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.","status":"published","published":"2026-11-11T06:17:15.643Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}