What is GHSA-qpw5-3rj5-433c?

GHSA-qpw5-3rj5-433c is a security advisory published by GitHub Security Advisories with unknown severity. The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly...

Which CVE IDs does GHSA-qpw5-3rj5-433c cover?

GHSA-qpw5-3rj5-433c covers the following CVE IDs: CVE-2026-86817. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-qpw5-3rj5-433cunknown

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly...

Vendor

GitHub Security Advisories

Published

October 4, 2026

Last Modified

October 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-86817 →

📋 Description

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86817
https://wpscan.com/vulnerability/2a400958-7ed8-4358-a46a-2b8e0716a771
https://github.com/advisories/GHSA-qpw5-3rj5-433c