Participants Database CVE-2026-112862

The flaw lives in xnau webdesign's Participants Database WordPress plugin, versions n/a through 2.7.8.5, so a vulnerable version of this specific plugin must be installed and active on a WordPress site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required against a reachable instance. A practical LIMITING factor inherent to PHP object injection: meaningful impact (code execution, file write/delete) typically requires a usable POP gadget chain in the plugin, WordPress core, or another installed plugin - the available sources do not describe the trigger or confirm such a chain, so impact may vary by installation. No fixed version is stated in the provided evidence.

Signals point toward genuine priority: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a network-reachable, unauthenticated flaw requiring no user interaction, and the vuln.today Decision label is act_now, consistent with a CWE-502 deserialization/PHP object injection issue in a WordPress plugin. However, several key signals are MISSING and must not be presented as confirmed: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and there is no confirmed proof-of-concept - the single reference is the Patchstack advisory entry, not working exploit code. No SSVC automatable/technical-impact breakdown beyond the act_now label is supplied. An important caveat specific to PHP object injection: achieving the full C:H/I:H/A:H impact generally depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin; the available description does not state the trigger or confirm a gadget chain, so the real-world impact may be lower than the 9.8 base score in hardened or minimal installations. Net: treat as high priority for patching per the act_now label, but recognize that exploitation maturity is unproven and impact is gadget-dependent.

A remote, unauthenticated attacker submits crafted serialized PHP data to an endpoint exposed by the Participants Database plugin (versions through 2.7.8.5), which deserializes it without validation, instantiating attacker-chosen objects. If a suitable POP gadget chain exists in the stack, this object injection could escalate to file operations or code execution; the exact trigger is not described in the available sources. No confirmed public exploit code was identified at the time of analysis - the only reference is the Patchstack advisory.