Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-82126

CVE-2026-82126LOW

Unknown Schema & Structured Data for WP & AMP — Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  L  N  N    2.7   .0030   20.5     —

AFFECTED
  Product                                Versions  Fixed
  Schema & Structured Data for WP & AMP  1.63 –    —

TIMELINE
  Aug 28  Reserved by WPScan
  Sep 16  Published (CNA: WPScan)
  Sep 17  EXPLOIT PUBLISHED — CVE-2026-82126 (Unknown Schema & Structured Data for WP & AMP). Public exploit reference added.

CWE-284 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 28, 2026	Reserved	Reserved by WPScan
September 16, 2026	Published	Published (CNA: WPScan)
September 17, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-82126 (Unknown Schema & Structured Data for WP & AMP). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Unknown	Schema & Structured Data for WP & AMP	—	1.63	—

Weaknesses

CWE-284

References (1)

https://wpscan.com/vulnerability/c6476bdd-1360-449f-b7be-6c532efe9de9/

Authoritative record: CVE-2026-82126 at cve.org

Weaknesses: CWE-284

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82126 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.