CVE-2026-82124

Medium CVSS 5.3

Published 2026-09-16 · last changed 2026-09-17

The fix

We hold no Microsoft remediation data for CVE-2026-82124, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.

Sources

NVD record for CVE-2026-82124

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N