CVE-2026-9067: Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

Synopsis

An unauthenticated arbitrary file upload vulnerability affects the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60. The plugin exposes frontend AJAX file-upload handlers that skip both capability checks and file-content validation, meaning any unauthenticated remote user can upload arbitrary file types to the WordPress media library. Successful exploitation gives an attacker the ability to plant files on the server and read or tamper with sensitive site data. A patched-image rebuild at version 1.60 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX endpoints are exposed over the network, so the attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the plugin performs no capability check before accepting uploads.

• Victim interactionNot required

  The attacker contacts the upload endpoints directly and no user action on the target site is required to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: a standard HTTP multipart upload request to the exposed endpoint is sufficient with no race conditions or environmental factors to manage.

Blast Radius

• An attacker can write arbitrary files accepted by the WordPress media library to the server's file system, which can be used as a stepping stone to remote code execution if a PHP-executable path is reachable.
• Confidential files accessible to the web server process, including configuration files and stored credentials, can be read by leveraging uploaded scripts or probing accessible paths.
• Site content and stored media can be replaced or corrupted, defacing the site or poisoning structured-data feeds consumed by downstream services.
• The presence of attacker-controlled files in the media library persists across restarts, giving the attacker a durable foothold even if the initial upload vector is later closed.