CVE-2026-86817 in Five Star Business Profile and Schema Plugin
Summary
by MITRE • 10/04/2026
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The Five Star Business Profile and Schema WordPress plugin prior to version 2.4.0 contains a critical information disclosure vulnerability stemming from improper validation of callback functions used for resolving default schema field values. This flaw allows authenticated users with Author-level access or higher to inject malicious input that is subsequently rendered in public-facing output without adequate sanitization. The core technical issue lies in the plugin's failure to restrict which callbacks can be executed when processing user-supplied data, effectively creating a vector where controlled inputs are interpreted as executable logic or passed directly into rendering functions that expose internal system states.
This vulnerability enables an attacker with relatively low privileges, such as an Author account, to manipulate how schema fields are resolved and displayed on the frontend of the WordPress site. By crafting specific input payloads, these users can cause the application to retrieve and output sensitive server-side data that should remain confidential. The most severe consequence is the exposure of other users' password hashes stored within the WordPress database. Since modern WordPress installations store passwords as hashed values rather than plaintext, this disclosure does not immediately reveal login credentials but significantly facilitates offline brute-force attacks against these hashes. Additionally, arbitrary site option values are exposed, which may include configuration details, API keys, or internal paths that aid in further reconnaissance and targeted exploitation of the underlying infrastructure.
The operational impact extends beyond immediate credential theft to broader security implications for the entire WordPress ecosystem hosting this plugin. The disclosure of password hashes undermines the integrity of user authentication mechanisms across all accounts with similar hash algorithms, potentially leading to unauthorized access if weak passwords are used elsewhere or if rainbow tables match the exposed hashes. Furthermore, the leakage of arbitrary site options can reveal structural weaknesses in the server configuration, such as database hostnames, plugin directories, or third-party service endpoints, which attackers can leverage to craft more sophisticated attacks against the web application and its associated services.
From a classification perspective, this vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information, although in this case it is not strictly an error message but rather unintended data exposure through normal functional output. It also relates to CWE-749, where exposed dangerous methods or APIs are accessible by unauthorized actors due to insufficient access control on internal functions. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1005, Data from Local System, as it involves gathering information directly from the local system's storage and configuration files through a web application interface.
Mitigation strategies must prioritize immediate patching by upgrading the Five Star Business Profile and Schema plugin to version 2.4.0 or later, where these callback restrictions have been properly implemented. Until an update is applied, administrators should consider restricting user roles that can interact with schema fields to only those requiring it for business operations, thereby reducing the attack surface available to potential attackers. Additionally, implementing strict output encoding and validating all inputs against a whitelist of allowed characters or patterns can provide defense-in-depth measures. Regular security audits focusing on how third-party plugins handle data flow between user input and public-facing outputs are essential to prevent similar information disclosure vulnerabilities in WordPress environments.