CVE-2026-86817
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
MEDIUM 4.9EPSS 0.2%
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
- Affected
- Five Star Business Profile and Schema
- CVSS v3.1 CNA
- 4.9 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.23% chance of exploitation in the next 30 days, 13th percentile
- Published
- 2026-10-04
- Updated
- 2026-10-05