CVE-2026-13596

CriticalCVSS 9.1

Published: 01/08/2026(UTC)Updated: 03/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.

Risk Assessment

Risk of unauthorized database access, data leakage, modification or deletion of records, and in extreme cases server compromise.

Recommendation

Update the Participants Database plugin to version 2.7.8.4 or later.

Original NVD description (English source)

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.