CVE-2026-86817 | BDVDB-2026-382579 Detail

Description#

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-04Record published in the CVE List.
2. Version 22026-10-05Most recent update recorded in the CVE List.