CVE-2026-112862: WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

Q: Who can exploit this issue?

The reported CVSS vector indicates that exploitation can be performed remotely over the network, requires no privileges, and requires no user interaction. The vulnerability is rated critical with impacts to confidentiality, integrity, and availability.

Q: Which versions are affected?

Participants Database versions through 2.7.8.5 are affected. The available data does not identify a fixed version.

Published Oct 23, 2026

Updated

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Affected Software

1 affected component

xnau webdesign Participants Database<=2.7.8.5

Event History

Oct 23, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The reported CVSS vector indicates that exploitation can be performed remotely over the network, requires no privileges, and requires no user interaction. The vulnerability is rated critical with impacts to confidentiality, integrity, and availability.

Which versions are affected?