What is the CVSS score of CVE-2026-11354?

CVE-2026-11354 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Participants Database CVE-2026-11354

EUVD-2026-48466 MEDIUM

Missing Authorization (CWE-862)

2026-07-24 Wordfence

GHSA-jjqh-m423-q994

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Participants Database Xnau

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

9.1 CRITICAL

Full unauthenticated attack chain achieves complete PII read (C:H) and arbitrary record overwrite (I:H); vendor's C:N/I:L understates the chained impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:05 vuln.today

CVE Published

Jul 24, 2026 - 02:32 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.

AnalysisAI

Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.

Technical ContextAI

The Participants Database plugin (vendor: xnau, CPE: cpe:2.3:a:xnau:participants_database:*:*:*:*:*:*:*:*) is a WordPress plugin for managing event or membership participant databases. The root cause is CWE-862 (Missing Authorization): the update_query.php handler (L57 of the 2.7.8.3 tag) and participants-database.php (L2437, L1671) accept an arbitrary numeric 'id' parameter in action=update POST requests without verifying that the requester owns or is authorized to modify that specific record - a classic insecure direct object reference (IDOR). The nonce mechanism exposed via PDb_Shortcode.php (L1267) functions only as CSRF protection, not as an ownership or identity check; any visitor to a public-facing form page can harvest a valid nonce. Chaining action=update (to inject an attacker email) with a subsequent action=retrieve (which emails the private-access link) converts a write primitive into a full PII exfiltration path.

RemediationAI

A fix is present in the plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3606851%40participants-database&new=3606851%40participants-database; however, a specific patched release version number was not included in the source data and cannot be independently confirmed - site operators should check the WordPress plugin directory for any version newer than 2.7.8.3 and update immediately. If an update is unavailable or cannot be applied immediately, the most effective compensating control is to temporarily deactivate the plugin or remove all public-facing pages rendering the participant signup or record-access shortcodes, which eliminates the nonce-harvesting endpoint the attack chain requires. Blocking POST requests containing action=update or action=retrieve parameters at the WAF layer to non-authenticated sessions is a viable interim mitigation but requires careful regression testing to avoid breaking legitimate participant self-service flows.