What is GHSA-cwcg-79p4-f24h?

GHSA-cwcg-79p4-f24h is a security advisory published by GitHub Security Advisories with Critical severity. The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.60 does not check user...

Which CVE IDs does GHSA-cwcg-79p4-f24h cover?

GHSA-cwcg-79p4-f24h covers the following CVE IDs: CVE-2026-9067. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cwcg-79p4-f24h?

GHSA-cwcg-79p4-f24h has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-cwcg-79p4-f24hCriticalCVSS 9.1

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user...

Vendor

GitHub Security Advisories

Published

June 10, 2026

Last Modified

June 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-9067 →

📋 Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-9067
https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826
https://github.com/advisories/GHSA-cwcg-79p4-f24h