The Five Star Business Profile and Schema WordPress plugin, versions 2.3.20 and 2.3.21, and all releases before 2.4.0, contain a flaw that fails to enforce access restrictions on callback functions used to resolve schema field default values. An authenticated user with the Author role or higher can supply data to these callbacks, allowing that data to be embedded in public plugin output. When the supplied data includes sensitive material such as other users’ password hashes or arbitrary site option values, those details become visible to any visitor, leading to accidental leakage of confidential information. The flaw is a classic sensitive data exposure vulnerability.

This vulnerability affects the Five Star Business Profile and Schema WordPress plugin. Impacted releases are 2.3.20, 2.3.21, and all earlier builds before the 2.4.0 update. Updating to version 2.4.0 or later removes the unguarded callback behavior and mitigates the risk.

The EPSS score for this issue is less than 1 % and it is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild at this time. The CVSS score of 4.9 denotes a moderate severity. Exploitation requires a legitimate Author‑level account; once such privileges are available, an attacker can insert arbitrary content that will be rendered publicly. While there is no evidence of an active public exploit, the nature of the data exposed—password hashes and configuration values—means that an attacker with access could gain valuable information for further compromise.