CVE-2026-27436: WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability

Synopsis

An arbitrary code execution vulnerability exists in the Five Star Business Profile and Schema WordPress plugin at version 2.3.19 and earlier. The vulnerability is reachable over the network and requires a high-privilege account (such as a site administrator or editor-level user) to exploit, with no victim interaction needed. Successful exploitation gives the attacker full control over the host environment, including reading sensitive data, modifying content, and disrupting service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  The attacker must hold a high-privilege account (administrator or editor role) on the WordPress site before the exploit can be triggered.

• Victim interactionNot required

  No action by another user is needed; the attacker can trigger the vulnerability directly with their own authenticated requests.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• Reads any file accessible to the web server process, including WordPress configuration files that contain database credentials and secret keys.
• Modifies or deletes arbitrary files on the host filesystem, including plugin files, themes, and uploaded media.
• Executes arbitrary operating system commands on the host, enabling installation of backdoors or lateral movement to adjacent systems.
• Crashes or destabilizes the WordPress service, causing a denial of service for site visitors and administrators.