CVE-2026-28189

HighCVSS 7.4

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.

An attacker can delete critical system files or data, potentially leading to service disruption or data loss.

Update the Participants Database plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.