CVE-2026-112861
MediumCVSS 6.3Summary
The Participants Database plugin (participants-database) for WordPress by xnau webdesign up to version 2.7.8.5 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.7.8.5.
Risk Assessment
An attacker may bypass authorization mechanisms and gain access to data or functions they should not have permission for. This could lead to disclosure or modification of participant data.
Recommendation
Update the Participants Database plugin to the latest version (above 2.7.8.5). Review permission and access key configuration.
Other vulnerabilities in Participants Database
See all- CVE-2026-27423Medium
The Participants Database plugin for WordPress versions 2.7.8.4 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
- CVE-2026-112862Critical
The Participants Database plugin (participants-database) for WordPress by xnau webdesign is vulnerable to deserialization of untrusted data, allowing Object Injection. The issue affects versions up to and including 2.7.8.5.
- CVE-2026-112860Critical
The Participants Database plugin (participants-database) for WordPress by xnau webdesign contains an SQL Injection vulnerability (improper neutralization of special elements in an SQL command) enabling blind SQL injection. The issue affects versions up to and including 2.7.8.5.
- CVE-2026-13596Critical
The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.
- CVE-2026-59555Critical
The Participants Database plugin versions up to 2.7.8.3 allow unauthenticated arbitrary file deletion.
- CVE-2026-59525Critical
The Participants Database plugin versions up to 2.7.8.3 contain an unauthenticated SQL injection vulnerability. An attacker can send crafted requests to execute arbitrary SQL queries.
- CVE-2026-28189High
The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.
- CVE-2026-11354Medium
The Participants Database plugin for WordPress up to version 2.7.8.3 is vulnerable to Sensitive Information Exposure via the 'id' parameter. An unauthenticated attacker can overwrite any participant record and hijack the private access link, gaining full read and edit access to personal data.
- CVE-2025-58008Medium
The Participants Database plugin by xnau webdesign has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 2.7.6.3.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS