CVE-2026-86817: Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Five Star Business Profile and Schemato a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role or any higher-privileged role can exploit it. Unauthenticated visitors can read the disclosed data after it is placed in public output.
What data could be exposed?
The issue can disclose sensitive values such as other users' password hashes and arbitrary WordPress site option values.
Are sites running version 2.4.0 affected?
The issue affects versions before 2.4.0. Updating to version 2.4.0 or later removes the affected version range.
How can administrators determine whether disclosure may already have occurred?
Review publicly accessible site output generated through schema fields for unexpected sensitive values. Also investigate schema field default values created or modified by Author-level or higher accounts.