CVE-2026-86817 Information disclosure in Five Star Business Profile and Schema
Authenticated authors can expose sensitive data like password hashes and site options to unauthenticated visitors via schema field callbacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86817?
CVE-2026-86817 is a medium-severity vulnerability in Unknown Five Star Business Profile and Schema, published on 4 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Weakness: CWE-200
Which versions are affected by CVE-2026-86817?
How do I fix CVE-2026-86817?
No fix has been published for CVE-2026-86817 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86817 being exploited?
There is no known exploitation of CVE-2026-86817 in the wild and no public exploit code.
Sources
Also known as GHSA-qpw5-3rj5-433c.