CVE-2026-119034 Schema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review Filter
MediumCVSS 5.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress schema-and-structured-data-for-wp(WordPress) | < 1.70 | 1.70 |
References
- wpscan.com exploit technical-description vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org