WordPress security by component

Participants Database

Plugin description

Participants Database stores and manages participant records, with tools for displaying and updating entries through WordPress forms.

Participants Database (participants-database) is a WordPress plugin with 16 published CVE records in this archive. The latest tracked vulnerability was published Oct 23, 2026; the highest published CVSS base score is 10.

Plugin slug: participants-database

Latest vulnerability

CVE-2026-112862: Participants Database: Unsafe object deserialization

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 2.7.8.5.

PublishedOct 23, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for participants-database
		Safe version
Oct 23, 2026	CVE-2026-112862 Participants Database: Unsafe object deserialization An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 2.7.8.5.	See mitigation notes	CVE9.8
Oct 23, 2026	CVE-2026-112860 Participants Database: Blind SQL injection An unauthenticated attacker can supply input that reaches a database query without adequate separation of data from SQL syntax, altering query behavior. The export does not establish operating-system command execution or a particular query-stacking technique. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, limited availability impact. Affected versions: at most 2.7.8.5. Blind SQL injection is disclosed, but the extraction channel is not.	See mitigation notes	CVE9.3
Oct 20, 2026	CVE-2026-112861 Participants Database: Authorization bypass through a user-controlled key A low-privilege authenticated attacker can supply a user-controlled key that bypasses authorization in Participants Database. The CNA vector indicates limited confidentiality, integrity and availability impact. The exact WordPress role, key, endpoint, target object and affected operation are not disclosed; those omissions prevent a more specific input-to-operation account. Affected versions: at most 2.7.8.5.	See mitigation notes	CVE6.3
Aug 13, 2026	CVE-2026-28189 Participants Database: Arbitrary file deletion Participants Database is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 2.7.8.4.	2.7.8.5	CVE7.4
Aug 01, 2026	CVE-2026-13596 Participants Database exposes an unauthenticated SQL-injection path Participants Database before 2.7.8.4 places an unauthenticated request parameter into a database query without sufficient sanitization or escaping. A visitor can alter the generated SQL and query information available to the WordPress database account. The published.	2.7.8.4	CVE9.1
Jul 24, 2026	CVE-2026-11354 Participants Database public forms permit record takeover and PII access Participants Database through 2.7.8.3 exposes a nonce on public forms but does not bind an unauthenticated action=update submission's numeric id to the visitor's private pid. An attacker can overwrite another participant record, replace its email address and then use action=retrieve to receive the private access link, exposing and permitting edits to the record's collected personal information.	2.7.8.4	CVE5.3
Jul 23, 2026	CVE-2026-59555 Participants Database: Arbitrary file deletion Participants Database is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 2.7.8.3.	2.7.8.4	CVE10.0
Jul 23, 2026	CVE-2026-59525 Participants Database: SQL injection Participants Database is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.7.8.3.	2.7.8.4	CVE9.3
Jul 23, 2026	CVE-2026-27423 Participants Database: Broken access control Participants Database is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.7.8.4.	See mitigation notes	CVE4.3
Aug 13, 2024	CVE-2024-43141 Participants Database: Code execution Participants Database is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.8
Dec 19, 2023	CVE-2023-48751 Participants Database: Cross-site request forgery Participants Database is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3
Nov 09, 2023	CVE-2023-31235 Participants Database: Cross-site request forgery Participants Database is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4
Feb 28, 2023	CVE-2022-47612 Participants Database: Cross-site request forgery Participants Database is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3
Feb 11, 2020	CVE-2020-8596 Participants Database: SQL injection Participants Database is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending
Sep 04, 2017	CVE-2017-14126 Participants Database: Cross-site scripting Participants Database is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending
Jun 04, 2014	CVE-2014-3961 Participants Database: SQL injection Participants Database is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers