CVE-2026-86817
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
- State
- Published
- Severity
- 4.9 Medium
- Published
- Oct 4, 2026
- Updated
- Oct 5, 2026
- Reserved
- Sep 8, 2026
Description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
Five Star Business Profile and SchemaUnknown |
|
References
- https://wpscan.com/vulnerability/2a400958-7ed8-4358-a46a-2b8e0716a771/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.