CVE-2026-59555
CriticalCVSS 10.0Summary
The Participants Database plugin versions up to 2.7.8.3 allow unauthenticated arbitrary file deletion.
Risk Assessment
An unauthenticated attacker can delete critical system files, potentially leading to site downtime or data loss.
Recommendation
It is recommended to update the Participants Database plugin to a version later than 2.7.8.3.
Other vulnerabilities in Participants Database
See all- CVE-2026-27423Medium
The Participants Database plugin for WordPress versions 2.7.8.4 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
- CVE-2026-13596Critical
The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.
- CVE-2026-59525Critical
The Participants Database plugin versions up to 2.7.8.3 contain an unauthenticated SQL injection vulnerability. An attacker can send crafted requests to execute arbitrary SQL queries.
- CVE-2026-28189High
The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.
- CVE-2026-11354Medium
The Participants Database plugin for WordPress up to version 2.7.8.3 is vulnerable to Sensitive Information Exposure via the 'id' parameter. An unauthenticated attacker can overwrite any participant record and hijack the private access link, gaining full read and edit access to personal data.
Original NVD description (English source)
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.