# CVE-2026-9067: Magazine3 Schema & Structured Data for WP & AMP Arbitrary Media Upload

Source: https://junglewise.ai/threats/cve-2026-9067-magazine3-schema-structured-data-for-wp-amp-arbitrary-media-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-9067 · Severity: info · CVSS 5.3 · Published 2026-06-10

A vulnerability in a popular WordPress SEO plugin allows unauthorized users to upload files to the website's server. While the system prevents the upload of dangerous scripts like PHP, an attacker could still use the site to host unauthorized content (such as PDFs or ZIP files) or fill up the server's storage space. This could lead to reputational damage or increased hosting costs.

Technologies: [Magazine3 Schema & Structured Data for WP & AMP](https://junglewise.ai/threats/technologies/schema-structured-data-for-wp-amp). Vendors: [Magazine3](https://junglewise.ai/threats/vendors/magazine3).

## Quick answers

**Is CVE-2026-9067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9067 being exploited in the wild.

**How severe is CVE-2026-9067?** Informational severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** Magazine3 Schema & Structured Data for WP & AMP < 1.60.

**Is there a fix for CVE-2026-9067?** A patch was published on 2026-05-20: Fixed in version 1.60 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9067 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9067?** Check whether you run Magazine3 Schema & Structured Data for WP & AMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the frontend AJAX file-upload handlers `saswp_rf_form_image_upload` and `saswp_rf_form_video_upload`. The plugin fails to perform `current_user_can()` checks and relies on client-supplied 'Content-Type' headers for validation rather than verifying actual file content. While WordPress core's default filters prevent the upload of executable files (like .php or .html), unauthenticated attackers can upload any file type permitted by the media library (e.g., .zip, .pdf, .csv, .json). This can be used for hosting malicious payloads or performing a denial-of-service attack via disk exhaustion. The issue is fixed in version 1.60.

## Affected products

- Magazine3 Schema & Structured Data for WP & AMP < 1.60

## Timeline

- 2026-05-20: disclosed: Vulnerability details published by WPScan
- 2026-05-20: patched: Fixed in version 1.60
- 2026-06-10: advisory: CVE-2026-9067 published to NVD

## References

- [https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/](https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/)