Participants Database
Monthly
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in xnau webdesign Participants Database participants-database.4.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Participants Database plugin before 1.7.5.10 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in xnau webdesign Participants Database participants-database.4.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Participants Database plugin before 1.7.5.10 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.