The Schema & Structured Data for WP & AMP plugin contains a PHP Object Injection vulnerability that allows an attacker to inject serialized PHP objects. When the plugin processes user‑supplied data, the deserialization logic fails to validate the input, giving the attacker the ability to execute arbitrary code on the server. This flaw can lead to full compromise of the affected WordPress site, including data theft, defacement, or further lateral movement.

The vulnerability affects the Magazine3 Schema & Structured Data for WP & AMP plugin with versions 1.66 and earlier. No other vendors or products are listed as impacted.

The flaw is scored with a CVSS of 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, a likely attack vector is a web‑based request that submits crafted serialized data to the plugin’s processing endpoint. Successful exploitation requires that the WordPress site is reachable via a web interface and that the vulnerable plugin is active; no authentication requirement is specified in the provided data.