Executive brief
The Schema & Structured Data for WP & AMP WordPress plugin generates structured data (JSON-LD schema markup) for posts but fails to check if a post is password-protected before including its content. This allows unauthenticated visitors to read the full text of password-protected posts via the publicly-accessible structured data output, bypassing the intended content restrictions.
Technical details
The vulnerability is a sensitive data exposure flaw (CWE-200) in the schema generation logic. The plugin does not validate password protection status before outputting post content in JSON-LD structured data, which is served via multiple public routes. An unauthenticated attacker can access these public endpoints without authentication or user interaction to retrieve the full content of password-protected posts. The vulnerability affects versions before 1.66, which contains the fix. Attack vector is network-based with no authentication required.
Affected products
- Schema & Structured Data for WP & AMP Schema & Structured Data for WP & AMP before 1.66
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 1.66