Schema & Structured Data for WP & AMP: Missing authorization in backup import
Summary
The WordPress plugin Schema & Structured Data for WP & AMP does not check whether the importing user may edit the posts contained in a settings backup, and does not restrict the import to its own post types. An authenticated user whose role an administrator has granted access to the plugin settings can therefore modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. Anonymous attackers cannot exploit this issue.
Affected
- Schema & Structured Data for WP & AMP versions before 1.70 (CVE record: 0 to before 1.70; VulDB describes up to 1.69)
Fixed in
- Version 1.70 or later
Workaround
- Until the update is applied, restrict access to the plugin settings to full administrators only (VulDB recommendation, not a vendor statement).
- Review which non-admin roles have been granted access to the plugin settings and remove them.
Exploitation
- No public exploit found at the time of research (VulDB, OffSeq).
- No evidence of exploitation in the wild found; the aggregator snapshot from 10-11 Nov 2026 lists the CVE as not in CISA KEV.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
Our recommendation
- Update the plugin to version 1.70 or later.
- Until then, limit plugin settings access to administrators and review roles with this access.
- Check whether the site has several editors or agency accounts, as these increase exposure.
- Also update for related fixes in the same release (CVE-2026-119033, CVE-2026-119035), which affect Contributor and higher roles.
- Monitor the WPScan advisory and NVD for changes, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability advisory wpscan.com
- CVE Record CVE-2026-119032 www.cve.org
- VulDB CVE-2026-119032 vuldb.com
- VulDB vulnerability 435656 vuldb.com
- Plugin listing (InstaWP) instawp.com
- OffSeq Radar threat entry radar.offseq.com
- Strix CVE-2026-119033 www.strix.ai
- OpenCVE CVE-2026-119035 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:06.
Original description (NVD)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.