PT-2026-48389 · WordPress · Schema & Structured Data For Wp & Amp

0Xbassia · CVE-2026-9067 · Published 2026-06-10 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Schema & Structured Data for WP & AMP versions prior to 1.60

Description The plugin fails to verify user capabilities within its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the intended media type of the endpoint. This allows unauthenticated users to upload any file type supported by the WordPress media library through endpoints that are specifically intended to accept only images or videos.

Recommendations Update to version 1.60 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-9067

Affected Products

Schema & Structured Data For Wp & Amp

References · 7

• 🔥 https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9067 · Security Note
• https://twitter.com/CVEnew/status/2064709845865943353 · Twitter Post
• https://twitter.com/infoflowcloud/status/2064710679202820317 · Twitter Post
• https://t.me/cveNotify/166798 · Telegram Post
• https://t.me/cveNotify/166814 · Telegram Post
• https://t.me/CVEtracker/56427 · Telegram Post