CVE-2026-82125: Schema & Structured Data Plugin Disclosure Flaw

CVE-2026-82125 Overview

CVE-2026-82125 affects the Schema & Structured Data for WP & AMP WordPress plugin in versions prior to 1.66. The plugin fails to verify comment ownership or moderation status before returning comment content through its endpoints. Unauthenticated attackers can read comments awaiting moderation or already flagged as spam. The vulnerability is classified under [CWE-639] as an Insecure Direct Object Reference (IDOR). Site owners rely on moderation to filter abusive, private, or spam submissions before publication. This flaw exposes that content to any anonymous requester.

Critical Impact
Unauthenticated remote attackers can retrieve unmoderated and spam-flagged comment content, exposing information site owners intended to keep private.

Affected Products

Schema & Structured Data for WP & AMP WordPress plugin versions before 1.66
WordPress sites using the plugin for schema markup generation
AMP-enabled WordPress deployments integrating this plugin

Discovery Timeline

2026-09-16 - CVE-2026-82125 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-82125

Vulnerability Analysis

The Schema & Structured Data for WP & AMP plugin generates structured data markup for WordPress content, including comments. The plugin exposes an endpoint that returns comment content based on a supplied identifier. It does not check whether the requesting user owns the comment or whether the comment has passed moderation.

An unauthenticated attacker can enumerate comment identifiers and retrieve content for any comment in the database. This includes comments held in the moderation queue and comments already marked as spam. Both categories typically contain data the site owner has chosen not to publish.

The exposure is limited to confidentiality of comment text and associated metadata. Attackers cannot modify data or affect site availability through this flaw. However, unmoderated comments frequently contain personally identifiable information, private replies, or content submitted with an expectation it would be reviewed before public visibility.

Root Cause

The root cause is a missing authorization check on a data-returning endpoint. The plugin trusts the supplied comment identifier without validating either the requester's relationship to the comment or the moderation status (comment_approved) of the target record. This pattern maps directly to [CWE-639]: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires only network access to a vulnerable WordPress site. The attacker issues HTTP requests to the plugin endpoint with sequentially or randomly chosen comment identifiers. No authentication, user interaction, or elevated privileges are required. Refer to the WPScan Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-82125

Indicators of Compromise

Unauthenticated HTTP requests targeting the Schema & Structured Data plugin endpoints with varying comment ID parameters
Sequential or high-volume enumeration patterns against comment-related plugin routes
Requests originating from a single source across a wide range of comment identifiers in a short timeframe

Detection Strategies

Review web server access logs for anonymous requests to plugin routes referencing comment identifiers
Alert on repeated 200-response patterns to comment enumeration attempts from unauthenticated sessions
Correlate WordPress plugin version data with the 1.66 patch threshold to identify exposed hosts

Monitoring Recommendations

Enable verbose access logging at the reverse proxy or web application firewall (WAF)
Monitor for burst traffic against /wp-json/ or plugin-specific AJAX endpoints querying comment data
Track outbound data volumes from WordPress hosts that could indicate bulk comment extraction

How to Mitigate CVE-2026-82125

Immediate Actions Required

Update the Schema & Structured Data for WP & AMP plugin to version 1.66 or later on all WordPress installations
Audit the moderation queue and spam folder for sensitive content that may have been exposed
Review web server logs for enumeration activity predating the patch deployment

Patch Information

The vendor addressed the flaw in version 1.66 by adding ownership and moderation status verification before returning comment content. Administrators should confirm the running plugin version through the WordPress dashboard or the wp plugin list WP-CLI command. Details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the plugin until it can be updated to version 1.66 or later
Restrict access to the plugin's endpoints at the WAF layer for unauthenticated sources
Purge stale spam and pending comments containing sensitive data to reduce exposure surface

bash

# Update the plugin using WP-CLI
wp plugin update schema-and-structured-data-for-wp --version=1.66

# Verify installed version
wp plugin get schema-and-structured-data-for-wp --field=version