WordPress Participants Database: unauthenticated SQL injection exposes site database

1. NVD2026-10-23 21:57 UTC · published 2026-10-23 09:17 UTC · CVE-2026-112860
2. InfraStack analyst2026-10-23 22:11 UTC · published 2026-10-23 22:11 UTC
   “Read Patchstack advisory, NVD and the WordPress.org plugin page. Patchstack marks the flaw unauthenticated, and no patch exists. The plugin is closed on WordPress.org since Oct 19. Not found exploited and no PoC. Did not search social posts, since the CVE is hours old. Fix field is unknown/none; check the plugin page for a new release.”
3. InfraStack analyst2026-10-23 22:37 UTC · published 2026-10-23 22:37 UTC
   “Re-checked: no patched release. WordPress.org page still shows closed since Oct 19 with latest 2.7.8.5, and the tag mirror lists no tag after 2.7.8.5 (Jul 31). Added WPScan page for an earlier, different SQLi (CVE-2026-13596, fixed in 2.7.8.4) that has a public PoC. That is a sibling, not a PoC for this CVE, and it shows the same attack surface (list search) was hit before. Exploited stays false and no PoC for this CVE was found.”
4. EPSS2026-10-24 07:15 UTC · CVE-2026-112860

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-112860 · 10-23 21:57
• EPSS: CVE-2026-112860 · 10-24 07:15
• Patchstack: Participants Database <= 2.7.8.5 SQL Injection (unauthenticated, no patch)Advisory · InfraStack analyst
• Participants Database on wordpress.org (closed Oct 19, 2026)Mitigation · InfraStack analyst
• NVD CVE-2026-112860Describes it · InfraStack analyst
• WPScan: Participants Database < 2.7.8.4 unauthenticated SQLi via list search (earlier CVE-2026-13596, with PoC)Mentions it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-112860")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.