CVE-2026-86817

4.9 Moyenne

Publiée le 04/10/2026 à 09:16 · Modifiée le 06/10/2026 à 17:18 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

Traduire en français

Produits concernés

Unknown Five Star Business Profile and Schema

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-200

Références

https://wpscan.com/vulnerability/2a400958-7ed8-4358-a46a-2b8e0716a771/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories