EUVD-2026-41338
GHSA-5qwh-74pw-p44j
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable authenticated code injection requiring an Editor/high-privilege role (PR:H), no user interaction, with RCE breaching the host beyond the plugin (S:C) and full C/I/A loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
AnalysisAI
Remote code execution in the Five Star Business Profile and Schema WordPress plugin (versions up to and including 2.3.19) allows an attacker holding an Editor-level or higher account to inject and execute arbitrary PHP code on the host. Reported by Patchstack and rated CVSS 9.1 due to its scope-changing impact, the flaw turns a trusted content role into full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-94 code-injection root cause makes reliable exploitation straightforward for any authorized high-privilege user.
Technical ContextAI
The affected component is a WordPress plugin published by the vendor 'rustaurius' (CPE cpe:2.3:a:rustaurius:five_star_business_profile_and_schema), which adds business-profile and schema.org structured-data functionality to WordPress sites. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection): attacker-controlled input reaches a PHP execution sink - typically eval(), call_user_func(), a dynamic include, or serialized/templated data that is later interpreted as code - without adequate validation. Because WordPress runs as a single PHP process, injected code executes with the privileges of the web server, which is why CVSS marks a scope change (S:C) reaching beyond the plugin's own security context to the underlying host.
RemediationAI
Upgrade the Five Star Business Profile and Schema plugin to the first release above 2.3.19; the input data confirms all versions through 2.3.19 are vulnerable but does not specify the exact fixed version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/business-profile/vulnerability/wordpress-five-star-business-profile-and-schema-plugin-2-3-19-arbitrary-code-execution-vulnerability) and the plugin's WordPress.org changelog for the patched build. Until patched, the most effective compensating control is to reduce the required privilege by auditing and minimizing accounts with Editor or higher roles and revoking access from untrusted or unnecessary users, since exploitation depends on holding such a role; enforce strong authentication and MFA on all privileged accounts to prevent account takeover (trade-off: adds login friction for legitimate authors). If the plugin's functionality is non-essential, deactivate and remove it entirely (trade-off: loss of business-profile/schema output and potential SEO impact). Optionally place a WAF or virtual patch in front of the plugin's admin endpoints to block code-injection payloads (trade-off: signatures may be incomplete and can produce false positives).
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today