Participants Database CVE-2026-112861

Exploitation requires an authenticated account on the WordPress site (CVSS PR:L), so the attacker must be a registered user - this is most relevant on installations of Participants Database that permit untrusted or self-service user registration. The core condition is the plugin's reliance on a user-controlled key (record identifier) without enforcing proper access-control levels, per CWE-639; where the plugin is correctly configured with strict access controls the issue is described as arising from 'Incorrectly Configured Access Control Security Levels,' so hardened/non-default access-level configurations limit exposure. No user interaction is needed (UI:N) and the attack is remote over the network (AV:N), but impact is limited to LOW across confidentiality, integrity, and availability, bounding the realistic damage to participant-record data rather than full site compromise.

This is a moderate-severity (CVSS 6.3) authorization flaw (IDOR, CWE-639) in the Participants Database WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates a network-exploitable, low-complexity attack requiring low-level authenticated privileges (PR:L) with no user interaction, yielding limited confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation - this appears to be a vendor/researcher-disclosed issue rather than an urgent in-the-wild threat. The combination of required authentication (PR:L) and only LOW impact across C/I/A makes this a realistic but not emergency priority: it should be patched in routine cycles, especially on sites that allow untrusted user registration, but it does not rise to the drop-everything level of an unauthenticated RCE. Note the Tags label this 'Authentication Bypass' while the CWE (639) and reference title describe Insecure Direct Object Reference / authorization bypass - these are distinct and the authorization-bypass characterization is the accurate one.

A low-privileged authenticated user (e.g., a registered site member or subscriber) manipulates a user-controlled identifier - such as a record ID in a request parameter - to access or modify participant records belonging to other users that they should not be authorized to reach. Because the plugin relies on a user-supplied key without properly enforcing access-control levels, the attacker reads or alters other participants' data over the network with low complexity and no user interaction. No public exploit code was identified at time of analysis.