Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

CVE-2026-27436 describes an Arbitrary Code Execution vulnerability affecting the Five Star Business Profile and Schema WordPress plugin in versions 2.3.19 and below. The vulnerability can be exploited by users with Editor-level access, allowing them to execute arbitrary code on the affected WordPress installation. This type of vulnerability poses a significant risk as it could lead to full site compromise, data theft, or further lateral movement. The issue has been reported via both the NVD and Patchstack vulnerability databases. WordPress site administrators running the affected plugin version are advised to update immediately to a patched version. The vulnerability is classified with a high severity rating.