Five Star Business Profile and Schema <= 2.4.0 - Authenticated (Author+) Missing Authorization to Site-Wide Schema Rule Creation and Modification
- ID
- WPSEC-2026-1544
- Plugin
- Five Star Business Profile and Schema (business-profile)
- Affected
- from 2.0.0 before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Five Star Business Profile and Schema on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Business Profile and Schema plugin for WordPress is vulnerable to unauthorized modification of data via the Schema rule post type in versions 2.0.0 up to, and including, 2.4.0, due to the schema post type being registered with the default post capabilities, so that the edit_post check in save_schema_meta() is passed by any user who can create posts. This makes it possible for authenticated attackers, with author-level access and above, to create and publish schema rules, which are meant to be managed by administrators, and inject attacker-chosen structured data (JSON-LD) into site-wide or other users' page output.
References
- https://wpsec.com/vuln/WPSEC-2026-1544/
- https://plugins.svn.wordpress.org/business-profile/tags/2.5.0/
- https://wordpress.org/plugins/business-profile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS