What is the CVSS score of EUVD-2026-48191?

EUVD-2026-48191 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Participants Database are affected by EUVD-2026-48191?

The Participants Database WordPress plugin (versions 2.7.8.3 and earlier) contains a critical unauthenticated SQL injection vulnerability (CVSS 9.3) that allows remote attackers to extract sensitive…

How to fix or mitigate EUVD-2026-48191?

Within 24 hours, immediately disable the Participants Database WordPress plugin on all affected WordPress installations (versions <= 2.7.8.3); if the plugin is business-critical, implement emergency access controls by restricting database connections to a whitelist of authorized application servers and adding Web Application Firewall (WAF) rules to block SQL injection patterns. Within 7 days, monitor the Patchstack advisory and plugin repository for a vendor-released patch to Participants Database; if available, schedule patching to the latest version. Within 30 days, if no patch has been released, execute a long-term remediation plan: either identify and deploy an alternative participant management solution or, if the plugin remains essential, establish permanent network segmentation and advanced monitoring; simultaneously, conduct a forensic audit of the WordPress database for evidence of unauthorized access or data extraction during the vulnerability window, and rotate all WordPress administrator credentials, database user passwords, and any API tokens stored in the database.

Participants Database EUVD-2026-48191

| CVE-2026-59525 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-chgx-4rph-2pm7

WordPress SQLi Wordpress Plugin Participants Database Roland Barker

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data dump (C:H) and possible data manipulation (I:L); scope kept S:U absent proof of cross-component impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:26 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

AnalysisAI

Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Participants Database is a WordPress plugin (vendor CPE roland_barker:participants_database) used to build and manage signup/participant lists and directories, storing records in the site's MySQL/MariaDB database. The flaw is classified CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input reaches a database query without proper parameterization or escaping. Because WordPress plugins typically run queries against the shared wp_ database, a successful injection can traverse beyond the plugin's own tables into core WordPress tables (wp_users, wp_options), which is consistent with the reported Scope:Changed (S:C) metric in the input vector.

RemediationAI

Upgrade the Participants Database plugin to the vendor's patched release that supersedes 2.7.8.3 (the exact fixed version is not confirmed in the provided data - verify the current version via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-3-sql-injection-vulnerability and the WordPress.org plugin page before deploying). If an immediate update is not possible, deploy a Web Application Firewall (such as Patchstack's or a WAF ruleset targeting SQLi patterns) to filter malicious input to the plugin's endpoints, restrict or disable public-facing Participants Database forms and shortcodes that accept unauthenticated input, and consider temporarily deactivating the plugin - accepting the trade-off that participant signup/list functionality will be unavailable. Ensure database backups exist so any suspected data compromise can be assessed.