# Five Star Business Profile and Schema <= 2.4.0 - Authenticated (Author+) Missing Authorization to Site-Wide Schema Rule Creation and Modification

- **ID:** WPSEC-2026-1544
- **Plugin:** Five Star Business Profile and Schema (`business-profile`), https://wordpress.org/plugins/business-profile/
- **Affected versions:** from 2.0.0 before 2.5.0
- **Fixed in:** 2.5.0 (Update to 2.5.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/business-profile
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1544/

## Description

The Five Star Business Profile and Schema plugin for WordPress is vulnerable to unauthorized modification of data via the Schema rule post type in versions 2.0.0 up to, and including, 2.4.0, due to the schema post type being registered with the default post capabilities, so that the edit_post check in save_schema_meta() is passed by any user who can create posts. This makes it possible for authenticated attackers, with author-level access and above, to create and publish schema rules, which are meant to be managed by administrators, and inject attacker-chosen structured data (JSON-LD) into site-wide or other users' page output.

## References

- https://wpsec.com/vuln/WPSEC-2026-1544/
- https://plugins.svn.wordpress.org/business-profile/tags/2.5.0/
- https://wordpress.org/plugins/business-profile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1544/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.