What is the CVSS score of EUVD-2026-51700?

EUVD-2026-51700 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Participants Database are affected by EUVD-2026-51700?

SQL injection in Participants Database WordPress plugin (all versions before 2.7.8.4) allows unauthenticated attackers to read and modify the entire WordPress database without authentication.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51700?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51700. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51700?

Within 24 hours: Identify all WordPress installations using Participants Database plugin and immediately update to version 2.7.8.4 or later. Within 7 days: Verify patch deployment across all systems, review database access logs for suspicious SQL injection activity during the vulnerability window, and check for evidence of database modification. Within 30 days: Conduct full database integrity audit, restore from known-clean backups if tampering is detected, reset all database user credentials, and implement Web Application Firewall rules to block SQL injection patterns.

Participants Database EUVD-2026-51700

| CVE-2026-13596 CRITICAL

SQL Injection (CWE-89)

2026-08-01 WPScan

GHSA-xv54-r3hg-rvqj

WordPress SQLi Participants Database Unknown

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) yielding full database read and write (C:H/I:H) but no direct availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:22 vuln.today

CVSS changed

Aug 03, 2026 - 19:22 NVD

9.1 (CRITICAL)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

AnalysisAI

SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.

Technical ContextAI

Participants Database is a WordPress plugin used to build and manage directories of participants, members, or contacts, storing records in the WordPress MySQL/MariaDB backend. The root cause is CWE-89 (SQL Injection): a user-controlled request parameter is concatenated into a SQL query without proper sanitization or parameterization (e.g., failing to use $wpdb->prepare()), so attacker-supplied input is interpreted as query syntax. The affected CPE is cpe:2.3:a:unknown:participants_database, and the injection is reachable pre-authentication, meaning any visitor to a site running the plugin can reach the vulnerable code path.

RemediationAI

Upgrade to Participants Database 2.7.8.4 or later, which the vendor has released to fix the flaw (Vendor-released patch: 2.7.8.4). Until patching is possible, restrict or block access to the plugin's request handlers at the WAF or web-server layer and add SQL-injection rules to filter the affected parameter, accepting that WAF signatures may be bypassable and can produce false positives; where the plugin's public-facing features are not essential, consider deactivating it, which removes the exposure at the cost of the plugin's directory/list functionality. Review database and web logs for anomalous queries indicating prior exploitation. Consult the WPScan advisory (https://wpscan.com/vulnerability/e22227c8-506e-4188-a7a1-1952b41c47f5/) for specifics.