Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112860updated 25 Oct 2026, 17:05 UTC

Participants Database WordPress plugin can be tricked into running database commands

Attackers can send specially crafted input to this WordPress plugin and read data from the site's database, such as member details. The plugin does not properly check what users send it.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted input to the website
  2. 2Public web formPlugin accepts the unchecked input
  3. 3Database queryInput is used directly in SQL
  4. 4Data extractedAnswers reveal stored records bit by bit
  5. ResultAttacker reads site database contents

What happened

The participants-database plugin by xnau webdesign has a Blind SQL Injection flaw (CWE-89), where user input is not neutralized before being used in SQL queries.

Why it is dangerous: An attacker may be able to extract stored data from the website's database, including personal information of participants, without needing a login.

Are you affected?

You are affected if you run the Participants Database plugin (participants-database) from xnau webdesign at version 2.7.8.5 or earlier on a WordPress site.

Participants Database (participants-database) by xnau webdesign, all versions up to and including 2.7.8.5

What to do

  1. Check whether the participants-database plugin is installed and what version it is
  2. Update the plugin to a version newer than 2.7.8.5 as soon as a fixed release is available from the vendor
  3. If no update is available yet, disable the plugin until a fix is released

Timeline

  1. 23 Oct 2026, 09:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 09:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:05 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112860 · GHSA-pvv6-j57p-h6cv
CVSS
9.3 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 09:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Participants Database WordPress plugin can be tricked into running database commands · Zero Radar