Vulnary
← back to the feed
Critical· 9.1official fix available

CVE-2026-9067

The Schema & Structured Data for WP & AMP WordPress plugin allows unauthenticated users to upload any file type through its AJAX handlers because it does not check user permissions or validate file content. This flaw exists in versions before 1.60. An attacker could upload malicious files that the site would treat as legitimate media.

publishedJun 10, 2026
last modifiedJul 23, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
44th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 22, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Schema & Structured Data for WP & AMP WordPress plugin, versions prior to 1.60, used on WordPress sites.

02

Real-world impact

An attacker could upload arbitrary files, including scripts or malware, to the site’s media library, potentially leading to code execution, defacement, or data exfiltration.

03

Why this severity

The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no authentication, and can lead to complete compromise of the confidentiality and integrity of the site’s data. The lack of user checks and file validation makes it easy for attackers to upload harmful content.

04

What to do about it

official fix available
recommended steps
  1. 011. Update the Schema & Structured Data for WP & AMP plugin to version 1.60 or later.
  2. 022. Verify the plugin is updated.
  3. 033. Restart the site if necessary.

NVD-referenced vendor advisory

05

Timeline

  1. Jun 10, 2026 · Jun 10, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 23, 2026 · 12d ago
    Advisory updated
    The NVD record was last revised.
  3. Jul 23, 2026 · 12d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →