Roland Barker
Monthly
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.