WordPress security changelog
CRITICAL
CVE-2026-59555
Deferred
Participants Database: Arbitrary file deletion
Participants Database is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 2.7.8.3.
CVE / CNA score
10.0
CVSS 3.1 · audit@patchstack.com
NVD score
Pending
NVD has not published its own CVSS assessment.
- Component
- Participants Database
- Plugin slug
participants-database- Affected
- n/a through 2.7.8.3
- Safe version
2.7.8.4- Published
- Jul 23, 2026
This CVE was published Jul 23, 2026 and is one of 10 known issues for this plugin.
What to do
Patch or disable the affected component.
Update Participants Database to 2.7.8.4 or later, or disable and remove it until a fixed version is available.
Source record
Technical description
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References