What’s Vulnerable › Vulnerabilities
CVE-2026-86817: Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-04 · updated 2026-10-06
- Weakness: CWE-200
Description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Affected products
- Five Star Business Profile and Schema: from 2.3.20 before 2.4.0 — fixed in 2.4.0
How to fix
Upgrade to a fixed version: Five Star Business Profile and Schema 2.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86817 or the next vulnerability affects your stack