CVE-2026-9067

9.1 Critique

Publiée le 10/06/2026 à 09:16 · Modifiée le 23/07/2026 à 11:10 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

Traduire en français

Produits concernés

Unknown Schema & Structured Data for WP & AMP

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-434

Références

https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories