What is the CVSS score of CVE-2026-59555?

CVE-2026-59555 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Participants Database are affected by CVE-2026-59555?

The Participants Database WordPress plugin (versions ≤ 2.7.8.3) contains a critical path traversal vulnerability enabling unauthenticated remote attackers to delete any file accessible to the web…

How to fix or mitigate CVE-2026-59555?

Within 24 hours, immediately deactivate the Participants Database plugin to eliminate the attack surface. Within 7 days, upgrade to a patched version once released by the vendor, or migrate to an alternative participant management solution if the vendor does not commit to a specific patch timeline. Within 30 days, conduct a file integrity audit of wp-config.php and critical WordPress files, implement continuous file system monitoring on configuration files, establish a rapid-response patch deployment process, and verify backup procedures are tested and current.

Participants Database CVE-2026-59555

EUVD-2026-48201 CRITICAL

Path Traversal (CWE-22)

2026-07-23 Patchstack

GHSA-qghf-ghh2-vwvg

WordPress Path Traversal Wordpress Plugin Participants Database Roland Barker

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network path traversal (PR:N/AV:N/AC:L); deleting wp-config.php escalates beyond the plugin (S:C) enabling takeover, so I/A:H and C:H via consequent site compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:42 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

AnalysisAI

Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.

Technical ContextAI

Participants Database is a WordPress plugin (vendor CPE cpe:2.3:a:roland_barker:participants_database) used to build and manage directories of people, members, and signups with front-end forms and file upload/attachment handling. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a file-handling routine - typically a record deletion, attachment cleanup, or CSV/upload handler - accepts an attacker-controlled filename or path without canonicalizing or constraining it to an intended directory, so sequences like '../' escape the plugin's upload folder and reference arbitrary filesystem locations. Because the affected endpoint is reachable without authentication, the traversal executes with the privileges of the PHP/web-server process.

RemediationAI

Update the Participants Database plugin to the vendor-released fixed version above 2.7.8.3 as published on the WordPress plugin repository; the exact patched version is not stated in the provided data and must be confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-3-arbitrary-file-deletion-vulnerability) or the plugin changelog. If patching cannot be done immediately, deactivate and remove the plugin, since the flaw is unauthenticated and reachable remotely - deactivation removes the exposed endpoint but disables all participant directory functionality. As compensating controls, place a WAF/virtual patch rule in front of WordPress to block requests containing path-traversal sequences ('../', encoded variants) to the plugin's AJAX/admin-ajax and file-handling actions, and enforce least-privilege filesystem permissions so the web-server user cannot delete wp-config.php or core files (trade-off: overly strict permissions may break legitimate uploads/updates). Ensure verified off-host backups exist so deleted files can be restored.