Five Star Business Profile and Schema <= 2.3.21 - Authenticated (Author+) Sensitive Information Exposure via Schema Rule Field Defaults
- ID
- WPSEC-2026-0090
- Plugin
- Five Star Business Profile and Schema (business-profile)
- Affected
- from 2.0.0 before 2.4.0
- Remediation
- Update to 2.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Five Star Business Profile and Schema on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Business Profile and Schema plugin for WordPress is vulnerable to Sensitive Information Exposure via schema rule field defaults in versions 2.0.0 up to, and including, 2.3.21. Field default values saved on a schema rule are resolved as data-source expressions when the rule's JSON-LD is output: 'option <name>' returns any WordPress option, 'meta <key>' returns any post meta value of the targeted post, and the allowlisted get_the_author_meta function accepts an attacker-chosen field and user ID. Schema rules are registered with the default post capabilities, so authenticated attackers with Author-level access and above can publish a schema rule that writes arbitrary option values (for example stored API keys or SMTP credentials) and any user's email address or password hash into the public JSON-LD of a page. Arbitrary function calls through the same field were already restricted to an allowlist in 2.3.20 (CVE-2026-27436).
References
- https://wpsec.com/vuln/WPSEC-2026-0090/
- https://plugins.svn.wordpress.org/business-profile/tags/2.4.0/
- https://wordpress.org/plugins/business-profile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS