# SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.3 - Unauthenticated Limited File Upload via Review Media Upload

- **ID:** WPSEC-2026-2284
- **Plugin:** Review Schema – Review & Structure Data Schema Plugin (`review-schema`), https://wordpress.org/plugins/review-schema/
- **Affected versions:** all versions before 3.1.4
- **Fixed in:** 3.1.4 (Update to 3.1.4 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/review-schema
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2284/

## Description

The review-schema plugin for WordPress is vulnerable to limited file uploads via the rtrs_image_upload and rtrs_video_upload AJAX actions in all versions up to, and including, 3.1.3. This is due to the handlers checking only the browser-supplied MIME type and passing the file to wp_handle_upload() without limiting it to the configured image or video types. This makes it possible for unauthenticated attackers, when guest uploads are enabled, to upload any file type WordPress allows by default (such as documents or archives), rather than only the configured media types.

## References

- https://wpsec.com/vuln/WPSEC-2026-2284/
- https://plugins.svn.wordpress.org/review-schema/tags/3.1.4/
- https://wordpress.org/plugins/review-schema/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2284/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.