Participants Database EUVD-2026-108630

The target must run Participants Database (xnau webdesign) at a version through 2.7.8.5 with the vulnerable code path reachable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, meaning any internet-exposed affected site is potentially targetable. However, the exact feature, endpoint, or request parameter that triggers the injection is not described in the available sources, so it cannot be confirmed which plugin function (e.g., a public signup/list shortcode versus an admin screen) must be enabled or exposed; this is the key unverified limiting factor. No fixed version is explicitly stated in the input - remediation presumably requires upgrading past 2.7.8.5, but defenders should confirm the patched release with the vendor/Patchstack.

Signals mostly align toward elevated priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no authentication and no user interaction, and the PR:N metric is the only basis on which unauthenticated access is claimed here. CWE-89 blind SQL injection in a WordPress plugin is the kind of flaw that is routinely mass-scanned, and the vuln.today Decision label is 'act_now', reported by Patchstack. Against that, several corroborating signals are absent: no EPSS exploitation-probability score is provided, the vulnerability is NOT in CISA KEV, and no working exploit is confirmed - the single reference is the Patchstack advisory, not proof-of-concept code. So the 'act_now' urgency rests on the vulnerability class and unauthenticated network vector rather than on observed exploitation. One internal inconsistency worth flagging: Patchstack scored S:C/A:L, but a standard data-reading blind SQLi typically has no availability impact and no scope change - the 9.3 is inflated relative to a conventional SQLi assessment (see assessed vectors). Treat this as a genuine high-priority patch item for exposed WordPress sites, but note that widespread active exploitation is not evidenced by the available data.

An unauthenticated remote attacker sends crafted input to a parameter the Participants Database plugin passes into a SQL query, and because responses differ based on injected boolean or time-based conditions, the attacker iteratively infers database contents (e.g., WordPress user records and password hashes). Given AV:N/AC:L/PR:N/UI:N, this can be automated at scale against any internet-facing site running an affected version. No public exploit is identified at time of analysis, though the Patchstack advisory documents the issue.