CVE-2026-27436: Five Star Business Profile RCE Vulnerability

CVE-2026-27436 Overview

CVE-2026-27436 is an arbitrary code execution vulnerability affecting the Five Star Business Profile and Schema WordPress plugin in versions up to and including 2.3.19. The flaw allows authenticated users with Editor-level privileges to execute arbitrary code on the underlying server. The issue is categorized under [CWE-94] Improper Control of Generation of Code (Code Injection).

The vulnerability carries a network attack vector and a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Site owners running the affected plugin should treat this as a priority remediation item.

Critical Impact
An authenticated Editor can achieve arbitrary code execution on the WordPress host, leading to full site compromise and potential lateral movement within the hosting environment.

Affected Products

Five Star Business Profile and Schema WordPress plugin, versions <= 2.3.19
WordPress sites that grant Editor-level accounts to untrusted users
Hosting environments running the vulnerable plugin without web application filtering

Discovery Timeline

2026-07-02 - CVE-2026-27436 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-27436

Vulnerability Analysis

CVE-2026-27436 is an authenticated arbitrary code execution issue in the Five Star Business Profile and Schema plugin for WordPress. The plugin exposes functionality that improperly handles user-controlled input and allows it to be interpreted as executable code within the application context. An attacker holding an Editor role can supply crafted input that the plugin evaluates or otherwise transforms into runtime code paths.

Because the exploitation occurs within a PHP process managed by the WordPress runtime, successful abuse yields code execution with the privileges of the web server user. From that foothold, attackers can read WordPress secrets stored in wp-config.php, pivot into the database, drop persistent webshells, or tamper with content served to visitors. The scope-changed nature of the finding indicates that impact extends beyond the plugin itself to the broader WordPress installation and hosting stack.

See the Patchstack WordPress Vulnerability Analysis for additional details.

Root Cause

The root cause is improper control over the generation of code, aligned with [CWE-94]. Plugin functionality reachable by Editor users accepts input that flows into a code-generation or evaluation sink without sufficient sanitization or allow-listing. Trusting the Editor role for privileged operations without validating the payload contents produces the code injection primitive.

Attack Vector

Exploitation requires network access to the WordPress admin interface and valid Editor credentials. No user interaction is required beyond the authenticated attacker session. Once authenticated, the attacker submits crafted content through the vulnerable plugin endpoint, and the payload is processed by the server to trigger arbitrary code execution.

No verified public exploit code is available at publication time. Refer to the vendor advisory for technical specifics of the affected code path.

Detection Methods for CVE-2026-27436

Indicators of Compromise

Unexpected PHP files created under wp-content/plugins/business-profile/ or the WordPress uploads directory
New or modified administrator accounts appearing shortly after Editor logins
Outbound network connections from the web server to unfamiliar hosts following plugin activity
Anomalous entries in web server access logs targeting Business Profile plugin endpoints with large POST bodies

Detection Strategies

Inventory WordPress installations and identify sites running Five Star Business Profile and Schema at version 2.3.19 or earlier
Alert on Editor accounts invoking plugin actions that lead to file writes or process execution on the host
Correlate WordPress audit logs with web server process activity to surface code execution attempts

Monitoring Recommendations

Enable WordPress activity logging and forward events to a centralized SIEM for retention and analysis
Monitor file integrity on plugin directories and the WordPress core to identify unauthorized modifications
Baseline outbound network traffic from web hosts and alert on deviations that may indicate post-exploitation callbacks

How to Mitigate CVE-2026-27436

Immediate Actions Required

Update the Five Star Business Profile and Schema plugin to a version later than 2.3.19 as soon as the vendor releases a fix
Audit all accounts assigned the Editor role and remove access for users who do not require it
Rotate WordPress administrator passwords and API keys if unauthorized Editor activity is suspected
Review the WordPress site for webshells, unauthorized plugins, and modified core files

Patch Information

Refer to the Patchstack WordPress Vulnerability Analysis for the current patch status and remediation guidance. Apply the fixed plugin version through the WordPress plugin manager once available.

Workarounds

Deactivate the Five Star Business Profile and Schema plugin until a patched version is installed
Restrict WordPress admin access using IP allow-listing at the web server or WAF layer
Reduce Editor role assignments and enforce multi-factor authentication for all privileged WordPress accounts

bash

# Disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate business-profile
wp plugin status business-profile