EUVD-2026-57967
GHSA-ggcw-rwmj-9238
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Network-reachable path traversal with no authentication; UI:R reflects required victim action; S:C and A:H capture cross-boundary file deletion with no exfiltration component.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
AnalysisAI
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Technical ContextAI
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a class of flaw where user-supplied input containing sequences such as '../' or URL-encoded equivalents is passed to filesystem operations without adequate canonicalization or boundary enforcement. The affected product is the Participants Database WordPress plugin authored by Roland Barker (CPE: cpe:2.3:a:roland_barker:participants_database:*:*:*:*:*:*:*:*), versions up to and including 2.7.8.4. The plugin provides event registration and participant management functionality within WordPress. The traversal flaw permits the attacker-supplied path to escape the plugin's intended working directory and reference arbitrary locations on the server, which is reflected in the CVSS S:C (Scope Changed) metric - the impact extends to resources outside the vulnerable component's authorization scope.
RemediationAI
Update the Participants Database plugin to a version newer than 2.7.8.4, the last confirmed vulnerable release per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-4-arbitrary-file-deletion-vulnerability. The exact patched version number is not stated in the available intelligence - verify the current release in the WordPress plugin repository before deploying. If immediate patching is not feasible, temporarily deactivate the Participants Database plugin entirely to eliminate the attack surface, accepting the trade-off of disabling all participant registration and management functionality. As a compensating control, configure a web application firewall rule to block requests containing path traversal sequences (e.g., '../', '%2e%2e/', '%252e%252e/') directed at plugin endpoints, noting that WAF rules may require tuning to avoid blocking legitimate file references. Enforcing PHP open_basedir restrictions to confine the web server process to the WordPress document root limits the blast radius of any successful traversal attempt but does not eliminate the vulnerability. File integrity monitoring on critical WordPress files (wp-config.php, .htaccess, index.php) will enable rapid detection if exploitation occurs.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today