CVE-2026-9067
The Schema & Structured Data for WP & AMP WordPress plugin allows unauthenticated users to upload any file type through its AJAX handlers because it does not check user permissions or validate file content. This flaw exists in versions before 1.60. An attacker could upload malicious files that the site would treat as legitimate media.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Schema & Structured Data for WP & AMP WordPress plugin, versions prior to 1.60, used on WordPress sites.
Real-world impact
An attacker could upload arbitrary files, including scripts or malware, to the site’s media library, potentially leading to code execution, defacement, or data exfiltration.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no authentication, and can lead to complete compromise of the confidentiality and integrity of the site’s data. The lack of user checks and file validation makes it easy for attackers to upload harmful content.
What to do about it
- 011. Update the Schema & Structured Data for WP & AMP plugin to version 1.60 or later.
- 022. Verify the plugin is updated.
- 033. Restart the site if necessary.
NVD-referenced vendor advisory
Timeline
- Jun 10, 2026 · Jun 10, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.