What is the CVSS score of EUVD-2026-57967?

EUVD-2026-57967 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Participants Database are affected by EUVD-2026-57967?

The Participants Database WordPress plugin (versions 2.7.8.4 and earlier) contains an unauthenticated file deletion vulnerability enabling remote attackers to delete critical WordPress core and…

How to fix or mitigate EUVD-2026-57967?

Within 24 hours: Identify all WordPress installations using Participants Database plugin version 2.7.8.4 or earlier; immediately disable the plugin and verify current backups are available. Within 7 days: Complete inventory of affected systems, assess business-critical dependencies, and research alternative plugins to replace Participants Database functionality. Within 30 days: Monitor vendor advisory for patch availability; if no patch is released, implement Web Application Firewall (WAF) rules to block path traversal attempts and deploy file integrity monitoring on WordPress core and configuration directories.

Participants Database EUVD-2026-57967

| CVE-2026-28189 HIGH

Path Traversal (CWE-22)

2026-08-13 Patchstack

GHSA-ggcw-rwmj-9238

WordPress Path Traversal Wordpress Plugin Participants Database Roland Barker

7.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Network-reachable path traversal with no authentication; UI:R reflects required victim action; S:C and A:H capture cross-boundary file deletion with no exfiltration component.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:50 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.4

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

AnalysisAI

Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a class of flaw where user-supplied input containing sequences such as '../' or URL-encoded equivalents is passed to filesystem operations without adequate canonicalization or boundary enforcement. The affected product is the Participants Database WordPress plugin authored by Roland Barker (CPE: cpe:2.3:a:roland_barker:participants_database:*:*:*:*:*:*:*:*), versions up to and including 2.7.8.4. The plugin provides event registration and participant management functionality within WordPress. The traversal flaw permits the attacker-supplied path to escape the plugin's intended working directory and reference arbitrary locations on the server, which is reflected in the CVSS S:C (Scope Changed) metric - the impact extends to resources outside the vulnerable component's authorization scope.

RemediationAI

Update the Participants Database plugin to a version newer than 2.7.8.4, the last confirmed vulnerable release per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-4-arbitrary-file-deletion-vulnerability. The exact patched version number is not stated in the available intelligence - verify the current release in the WordPress plugin repository before deploying. If immediate patching is not feasible, temporarily deactivate the Participants Database plugin entirely to eliminate the attack surface, accepting the trade-off of disabling all participant registration and management functionality. As a compensating control, configure a web application firewall rule to block requests containing path traversal sequences (e.g., '../', '%2e%2e/', '%252e%252e/') directed at plugin endpoints, noting that WAF rules may require tuning to avoid blocking legitimate file references. Enforcing PHP open_basedir restrictions to confine the web server process to the WordPress document root limits the blast radius of any successful traversal attempt but does not eliminate the vulnerability. File integrity monitoring on critical WordPress files (wp-config.php, .htaccess, index.php) will enable rapid detection if exploitation occurs.