Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86817— Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

Quick assessment

Affected
Unknown Five Star Business Profile and Schema
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在2.4.0版本之前的Five Star Business Profile and Schema WordPress插件中，用于解析模式字段默认值的回调函数未得到适当限制，导致具备作者级及以上权限的已认证用户能够存储会泄露敏感数据的输入，包括其他用户的密码哈希值和任意网站选项值，这些信息会被存储在公开输出中，可供未认证的访客读取。

AI Predicted 6.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86817

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Five Star Business Profile and Schema 2.3.20 ~ 2.4.0 -

II. Public POCs for CVE-2026-86817

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86817

请登录查看更多情报信息。

Other References for CVE-2026-86817 (1)

Same Patch Batch · Unknown · 2026-10-04 · 6 CVEs total

CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
CVE-2026-97332 User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite
CVE-2026-17005 Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

IV. Related Vulnerabilities

Same product: Five Star Business Profile and Schema
Same vendor: Unknown

V. Comments for CVE-2026-86817

No comments yet

Leave a comment