CVE-2026-86817
N/A
N/A
Summary
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Five Star Business Profile and Schema | 2.3.20 < 2.4.0 | affected |
Weaknesses
- CWE-200 Information Exposure
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.