PatchSiren cyber security CVE debrief

CVE-2026-9067 Schema & Structured Data for WP & AMP CVE debrief

CVE-2026-9067 是一個影響 Schema & Structured Data for WP & AMP WordPress 外掛程式的嚴重漏洞。該漏洞由於外掛程式的 AJAX 檔案上傳處理程序未驗證使用者權限，且未檢查上傳檔案的內容是否與端點的媒體類型相符，允許未授權的使用者通過原本只允許上傳圖片或視頻的端點上傳任意類型的檔案。

Vendor: Schema & Structured Data for WP & AMP
Product: WordPress plugin
CVSS: CRITICAL 9.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-10
Original CVE updated: 2026-06-10
Advisory published: 2026-06-10
Advisory updated: 2026-06-10

Who should care

使用 Schema & Structured Data for WP & AMP WordPress 外掛程式的網站管理員和使用者。

Technical summary

CVSS 分數：9.1，CVSS 評級：CRITICAL。該漏洞允許未授權的使用者上傳任意檔案，可能導致網站被攻擊。

Defensive priority

高

Recommended defensive actions

升級 Schema & Structured Data for WP & AMP WordPress 外掛程式至 1.60 或以上版本。
檢查網站上是否有異常檔案上傳活動。
限制檔案上傳的大小和類型。

Evidence notes

來源：wpscan.com

Sources and references

Verified primary and authoritative sources

CVE-2026-9067 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-9067

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-9067 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9067

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://wpscan.com/vulnerability/7fac98eb-f82c-4705-a956-aba650945826/

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.