Vulnerability · Published Jun 10, 2026 · Assigned by WPScan

CVE-2026-9067Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

Critical 9.1

In plain English

A critical-severity unrestricted file upload in Schema & Structured Data for WP & AMP from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Schema & Structured Data for WP & AMP	0 – before 1.60

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/ exploit, vdb-entry, technical-description