CVE-2026-9067

Name of the Vulnerable Software and Affected Versions Schema & Structured Data for WP & AMP versions prior to 1.60

Description The plugin fails to verify user capabilities within its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the intended media type of the endpoint. This allows unauthenticated users to upload any file type supported by the WordPress media library through endpoints that are specifically intended to accept only images or videos.

Recommendations Update to version 1.60 or later.