CVE-2026-86817

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-06

Assigner: WPScan

Description

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86817

EUVD

EUVD-2026-92074

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Five	Star Business Profile and Schema 2.3.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Five Star Business Profile and Schema WordPress plugin before version 2.4.0. It allows authenticated users with Author-level access or higher to exploit improperly restricted schema field default callbacks. This can lead to storing sensitive data like other users' password hashes and site option values in public output, which is accessible to unauthenticated visitors.

Detection Guidance

Check the installed version of the Five Star Business Profile and Schema plugin. If it is below 2.4.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If you use the Five Star Business Profile and Schema plugin versions 2.3.20 to 2.3.21, attackers with Author-level access could expose sensitive data such as password hashes and site settings. This could lead to unauthorized access, data breaches, or further exploitation of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive user data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Five Star Business Profile and Schema plugin to version 2.4.0 or later immediately. Restrict Author-level user access to only necessary functions and review stored sensitive data in public output.

Hi! I’m here to help you understand CVE-2026-86817. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70