Threats tagged 'ghsa-qpw5-3rj5-433c'

CVE-2026-86817 is an information exposure vulnerability in the Five Star Business Profile and Schema WordPress plugin versions 2.3.20 up to but not including 2.4.0. Authenticated users with Author-level access or higher can exploit improper callback restrictions to disclose sensitive data such as other users' password hashes and arbitrary site option values. This sensitive information can be exposed in publicly accessible output, making it readable by unauthenticated visitors. The vulnerability has a medium severity with a CVSS score of 4.9.