CVE-2026-112860: WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
Published Oct 23, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Affected Software
1 affected component
xnau webdesign Participants Database<=2.7.8.5
Event History
Oct 23, 2026
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Participants Database versions through 2.7.8.5 are affected. The available data does not identify a fixed version.
2
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the potential impact of successful exploitation?
The vulnerability permits blind SQL injection and is rated critical with a 9.3 CVSS score. The vector indicates high confidentiality impact, no integrity impact, and low availability impact.