{"affected":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-119032","cwes":["CWE-862"],"description":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/"}],"kev":null,"metrics":[],"modifiedAt":1794376809200,"publishedAt":1794376809200,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/"}],"remediation":[],"revision":"b54fc9df84783ce941978890c0dbbd438eebda81a6c87264acfa9dbd4716aa29","sources":[{"modifiedAt":1794376809200,"name":"CNA: WPScan","retrievedAt":1794377379363,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119032"}],"ssvc":null,"status":"published","title":"Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import","updatedAt":1794377379363}