{"id":"CVE-2026-82124","aliases":["EUVD-2026-80187","GHSA-2q2q-2698-cw2q"],"status":"published","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00345,"percentile":0.28216,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-09-16T06:00:12Z","modified":"2026-09-17T15:32:06Z","products":[{"vendor":"magazine3","product":"schema \u0026 structured data for wp \u0026 amp"},{"vendor":"unknown","product":"schema \u0026 structured data for wp \u0026 amp"}],"references":[{"url":"https://wpscan.com/vulnerability/16c65787-c43a-42c6-94b8-5f748a1b0b25/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82124"},{"url":"https://wpscan.com/vulnerability/16c65787-c43a-42c6-94b8-5f748a1b0b25"},{"url":"https://github.com/advisories/GHSA-2q2q-2698-cw2q"}],"sources":{"cve":[{"id":"CVE-2026-82124","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.","status":"published","published":"2026-09-16T06:00:12.494Z","modified":"2026-09-17T12:38:39.622Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-80187","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.","status":"published","published":"2026-09-16T06:00:12Z","modified":"2026-09-17T12:38:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:13.171257Z"}],"ghsa":[{"id":"GHSA-2q2q-2698-cw2q","title":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a...","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.","status":"published","published":"2026-09-16T06:31:35Z","modified":"2026-09-17T15:32:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:04.687174Z"}],"nvd":[{"id":"CVE-2026-82124","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.","status":"published","published":"2026-09-16T06:16:33.167Z","modified":"2026-09-17T13:16:48.653Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:48.287983Z"}]}}