CVE-2026-86817: CWE-200 Information Exposure in Five Star Business Profile and Schema
Description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Affected software
Five Star Business Profile and Schema
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86817 describes an information exposure vulnerability (CWE-200) in the Five Star Business Profile and Schema WordPress plugin before version 2.4.0. The flaw arises because the plugin does not properly restrict the callbacks used to resolve schema field default values. Authenticated users with Author-level privileges or higher can inject input that causes sensitive data, including password hashes and site options, to be disclosed in public output accessible to unauthenticated visitors.
Potential Impact
Sensitive information including password hashes and arbitrary site option values can be exposed publicly. This could lead to further compromise of the WordPress site or user accounts if attackers leverage the disclosed data. The vulnerability requires authenticated access at Author level or above to exploit.
Mitigation Recommendations
Upgrade the Five Star Business Profile and Schema plugin to version 2.4.0 or later where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is not explicitly stated but the affected versions are prior to 2.4.0, indicating the fix is in 2.4.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T13:52:58.085Z
- State
- PUBLISHED
Threat ID: 6ac1f64ea43b0b3b8943476d
Added to database: 10/04/2026, 06:46:38 UTC
Last enriched: 10/04/2026, 07:01:18 UTC
Last updated: 10/04/2026, 09:37:36 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.