CVE-2026-9067 Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Unauthenticated attackers can upload arbitrary files via AJAX handlers, potentially leading to remote code execution on WordPress sites using this plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9067?
CVE-2026-9067 is a critical vulnerability in Unknown Schema & Structured Data for WP & AMP, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Weakness: CWE-434
Which versions are affected by CVE-2026-9067?
How do I fix CVE-2026-9067?
No fix has been published for CVE-2026-9067 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9067 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9067 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-cwcg-79p4-f24h.