The vulnerability resides in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60, where frontend AJAX upload handlers omit user capability checks and fail to validate the content type of files being uploaded. Based on the description, it is inferred that this enables any visitor to submit and store any file type that WordPress's media library accepts through endpoints intended to allow only images or videos. An attacker could use this to host malware or embed malicious content, potentially leading to data disclosure, integrity compromise, or remote code execution.

This flaw affects the Schema & Structured Data for WP & AMP plugin on all WordPress installations running any version prior to 1.60.

The CVE lacks an assigned CVSS score or EPSS value, and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be through the plugin's publicly exposed AJAX endpoints accessed via the website’s frontend. Because the upload process does not restrict file types or user permissions, it is inferred to be trivially exploitable by any unauthenticated user that can reach the site.