EUVD-2026-92074
GHSA-qpw5-3rj5-433c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Author-level user
-
ExploitInject malicious schema field default callback
-
ExecutionCallback resolves password hashes / site options
-
ImpactSensitive data rendered in public output
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at Author role or higher on a site running Five Star Business Profile and Schema 2.3.20-2.3.x. The attacker must use the plugin's schema field default-value resolution feature, which fails to restrict which callbacks may run, to reference sensitive server-side data (other users' password hashes or arbitrary wp_options values). The disclosed data is then emitted into public, unauthenticated-readable output. Limiting factors: exploitation is gated by possession of an Author+ account, so sites that do not permit untrusted users to hold Author or higher roles (or that disable open registration at that level) are not practically exposed despite the network attack vector. |
| Impact | This is a moderate, not high-urgency, issue. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, 4.9) scores it Medium, with high confidentiality impact but no integrity or availability impact. The EPSS probability is very low (0.14%, 3rd percentile) and it is NOT on CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code exists (WPScan), which raises practical risk above the EPSS figure for internet-facing, multi-author WordPress sites. A key signal conflict must be flagged: the vendor marks PR:H (high privileges), yet the description states the flaw is reachable by any 'Author-level access and above' account - Author is a mid-tier WordPress role, which conventionally maps to PR:L, not PR:H; this likely understates the true severity (PR:L would score ~6.5). Overall this is a real but lower-tier priority: patch it during normal maintenance, prioritizing sites that allow untrusted user registration at Author level or above. No SSVC decision data was supplied in the input. |
| Exploit ScenarioDerived | An attacker who holds (or registers for) an Author-level or higher account on a WordPress site running the vulnerable plugin abuses the unrestricted schema default-value callback to resolve sensitive server-side values. They craft a schema field whose default resolves to another user's password hash or an arbitrary wp_options value, which the plugin then emits into public page output readable by any unauthenticated visitor. Public exploit code is available from WPScan, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Authenticated WordPress users holding Author-level access or above can abuse the schema field default-value resolution feature in the Five Star Business Profile and Schema plugin (versions prior to 2.4.0, including 2.3.20 through 2.3.x) to pull sensitive server-side data into publicly rendered schema output, including other users' password hashes and arbitrary wp_options values, which unauthenticated visitors can then read. Publicly available exploit code exists, but CISA KEV does not list this issue and EPSS is only 0.14% (3rd percentile), so real-world exploitation pressure is low. This is a moderate, not high-urgency, issue: exploitation requires an existing Author or higher account, so sites that never grant that role to untrusted users are not practically exposed, though the vector is network-reachable (CVSS 4.9; CWE-200).
RemediationAI
Vendor-released patch: upgrade Five Star Business Profile and Schema to 2.4.0 or later (the description states the flaw exists in versions before 2.4.0, so 2.4.0 is the first fixed release); verify the installed plugin version in wp-admin and apply the update, and confirm the version change in the plugin UI since WordPress auto-update settings are frequently disabled on managed sites. Because password hashes and wp_options values may already be sitting in cached or indexed public pages, treat credentials as exposed: after upgrading, force a password reset for all users (or at minimum all Author-and-above accounts) and rotate secrets stored in wp_options such as API keys and salts, accepting the operational disruption that mass reset causes. For sites that cannot patch immediately, revoke or downgrade Author-and-above roles for anyone untrusted - set the default registration role to Subscriber, disable open registration, and audit the user list for stale or self-registered Authors (trade-off: this breaks legitimate contributor workflows until roles are restored). Also purge page caches and any search-engine/CDN copies of plugin-front-end pages so previously emitted schema output stops being served, and block or monitor the plugin's schema-rest endpoint if your WAF can scope it without breaking legitimate admin traffic. Consult https://wpscan.com/vulnerability/2a400958-7ed8-4358-a46a-2b8e0716a771/ for the researcher advisory and https://vuldb.com/vuln/413390 for additional detail; note that publicly available exploit code exists, so prioritize the upgrade on any site where Author accounts are broadly available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, in how the plugin resolves default values for schema fields. Rather than restricting the resolution to a fixed allowlist of internal callbacks, the plugin accepts attacker-influenced callback references and invokes them server-side, so a stored value supplied through the plugin's schema editing interface controls which function output is fetched. Because the callback runs in a WordPress context, it can return data such as user_pass entries from wp_users or arbitrary rows from wp_options, and that output is embedded in the plugin's front-end schema markup (typically JSON-LD) that is served to unauthenticated visitors. The CPE cpe:2.3:a:unknown:five_star_business_profile_and_schema:*:*:*:*:*:*:*:* is a wildcard entry with an unknown vendor, so the precise product/version mapping comes from the EUVD affected-version data (2.3.20 up to, but not including, 2.4.0) rather than from NVD's CPE dictionary. Two details drive the risk profile: the disclosed password hashes are WordPress phpass/bcrypt-style hashes that can be attacked offline once harvested, and the option disclosure can leak API keys, salts, or integration secrets stored in wp_options. Note the vector discrepancy between NVD's PR:H (CVSS 4.9) and our independent assessment of PR:L; the higher-privileged-author requirement reflects the role needed to reach the schema editing UI, and both readings agree that compromise of confidentiality is the sole impact (no integrity or availability effect).
Know when Five Star Business Profile And Schema gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Author-level access is a mid-tier role, so PR:L (not the vendor's PR:H); network-reachable with no user interaction, high confidentiality impact only, scope unchanged.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB