CVE-2026-82124 Overview
CVE-2026-82124 affects the Schema & Structured Data for WP & AMP WordPress plugin in versions before 1.66. The plugin fails to check whether a post is password protected before including its content in generated structured data. Unauthenticated attackers can retrieve the content of password-protected posts through more than one public output route. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Site operators relying on WordPress password protection to gate premium or private content are directly exposed.
Critical Impact
Unauthenticated attackers can read password-protected WordPress post content by requesting structured data endpoints exposed by the plugin.
Affected Products
- Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.66
- WordPress sites publishing structured data through the plugin
- Sites using WordPress native password protection for gated content
Discovery Timeline
- 2026-09-16 - CVE-2026-82124 published to the National Vulnerability Database
- 2026-09-17 - Last updated in the NVD database
Technical Details for CVE-2026-82124
Vulnerability Analysis
The Schema & Structured Data for WP & AMP plugin generates JSON-LD structured data for WordPress posts to improve search engine visibility. The plugin builds this markup by pulling post content directly from the WordPress database. It does not evaluate whether the source post has a post_password value set before serializing the content into the output.
WordPress natively hides password-protected post bodies from anonymous visitors, replacing them with a password prompt. The plugin bypasses this protection by reading raw post content and emitting it through public output routes accessible without authentication. According to the WPScan advisory, more than one route exposes the same data.
Root Cause
The root cause is a missing authorization check on protected content. The plugin trusts the post object returned by the database layer and does not invoke post_password_required() or an equivalent gate before rendering the content into schema markup. This is a classic information exposure defect under [CWE-200].
Attack Vector
Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends an HTTP GET request to the public URL of a password-protected post or to a related structured data endpoint served by the plugin. The response body contains schema markup that includes the raw post content in fields such as articleBody or description. The attacker parses the JSON-LD to recover the protected text.
No verified proof-of-concept code is published. See the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-82124
Indicators of Compromise
- Anonymous HTTP requests to URLs of password-protected posts returning non-empty JSON-LD <script type="application/ld+json"> blocks
- Access log entries showing repeated requests to protected post permalinks from a single client without corresponding password form submissions
- Requests targeting AMP variants of protected posts that return content instead of a password prompt
Detection Strategies
- Inventory WordPress sites and identify installations of the Schema & Structured Data for WP & AMP plugin below version 1.66
- Crawl the site as an unauthenticated user and inspect responses for password-protected posts to confirm whether schema markup leaks body content
- Correlate web server access logs with the list of protected post IDs to identify anomalous read patterns
Monitoring Recommendations
- Alert on high-volume anonymous access to permalinks or AMP endpoints associated with protected content
- Log and review outbound JSON-LD payload sizes for protected posts and flag any that exceed the size of a password prompt
- Track plugin version state across managed WordPress properties and generate alerts when vulnerable versions are detected
How to Mitigate CVE-2026-82124
Immediate Actions Required
- Update the Schema & Structured Data for WP & AMP plugin to version 1.66 or later on all WordPress installations
- Audit password-protected posts to determine whether any confidential content was exposed while the plugin was vulnerable
- Rotate or replace any secrets, links, or credentials that were stored inside password-protected posts
Patch Information
The vendor addressed the issue in version 1.66 of the Schema & Structured Data for WP & AMP plugin by adding a password protection check before including post content in generated structured data. Refer to the WPScan Vulnerability Report for the confirmed fixed version.
Workarounds
- Deactivate the Schema & Structured Data for WP & AMP plugin until the patched version is deployed
- Move sensitive content out of password-protected posts and into a properly access-controlled system such as a membership plugin with server-side enforcement
- Block anonymous requests to permalinks of protected posts at the web application firewall until the plugin is upgraded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
