Schema & Structured Data for WP & AMP: PHP object injection

Summary

The WordPress plugin Schema & Structured Data for WP & AMP up to and including version 1.66 contains a PHP object injection vulnerability (CWE-502). An authenticated user with Contributor rights can submit crafted data that the plugin unserializes, which can lead to code execution, data access or denial of service on the server, depending on other installed plugins and themes. No user interaction is required, but a valid Contributor account is needed.

Affected

• Schema & Structured Data for WP & AMP plugin, all versions up to and including 1.66
• Required privilege: Contributor
• Installations with self-registration granting Contributor rights or with external authors are most exposed

Fixed in

• Version 1.67 (per the CVE record and Patchstack; the vendor's 1.67 release notes list a fix by the same reporter, the link to this CVE is inferred)
• Current release at time of research: 1.69

Workaround

• No vendor workaround known.
• Until patched, review Contributor accounts and remove unneeded or unknown ones (inferred from the CVSS vector, not a vendor recommendation).
• If the plugin is not required, deactivate and remove it.

Exploitation

• CISA SSVC: exploitation none, not automatable, technical impact total.
• Patchstack expects exploitation and notes that similar flaws are used in mass-exploit campaigns.
• No public proof of concept confirmed at time of research; not listed in the CISA KEV catalog (not verified against the catalog).

Our recommendation

• Update the plugin to version 1.67 or later, preferably the current release, as part of the next update cycle or sooner.
• Review all accounts with Contributor or higher rights and remove unneeded ones.
• Restrict self-registration and check external author accounts.
• Monitor logs for unusual content submissions and unexpected plugin behaviour.
• If the Patchstack virtual patch is available for your site, enable it until the update is applied.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE-2026-97291 www.strix.ai
• TheHackerWire CVE-2026-97291 www.thehackerwire.com
• Vendor release notes 1.67 structured-data-for-wp.com
• Vendor release notes 1.69 structured-data-for-wp.com
• GitHub issue #2474 github.com
• GitHub repository github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:04.