{"id":"CVE-2026-112860","kind":"vulnerability","aliases":["CVE-2026-112860"],"related":[],"title":"WordPress Participants Database: unauthenticated SQL injection exposes site database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","summary":"Participants Database, a WordPress plugin by xnau webdesign, has a blind SQL injection flaw in versions through 2.7.8.5. An attacker can read data from the site's database by sending crafted requests, with no login needed according to the tags.","severity":"critical","cvss":9.3,"epss":0.00236,"exploited":false,"exploited_at":null,"products":[{"name":"participants-database","fixed":[],"affected":"<= 2.7.8.5","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["no-patch","package","participants-database","sql-injection","unauthenticated","wordpress"],"not_affected_if":["plugin-not-installed","version-above-2.7.8.5"],"how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get participants-database --field=version. Affected if 2.7.8.5 or older.","fix":"No fixed version as of 2026-10-23: 2.7.8.5 is the latest and WordPress.org has closed the plugin. Deactivate and remove it, or block public access to pages with the [pdb_list] shortcode, until a release newer than 2.7.8.5 appears. Patchstack offers a virtual-patch rule.","status":"open","published_at":"2026-10-23T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:27+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:31:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Participants Database: unauthenticated SQL injection exposes site database","impact":"high","summary":"Participants Database, a WordPress plugin by xnau webdesign, has a blind SQL injection flaw in versions through 2.7.8.5. An attacker can read data from the site's database by sending crafted requests, with no login needed according to the tags.","category":"package","who_cares":["wordpress","participants-database"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads database contents, including user and member records and password hashes","analyst_note":"Sources list no fixed version and tag no-patch; confirm whether a patched release exists at https://nvd.nist.gov/vuln/detail/CVE-2026-112860 and the plugin's WordPress.org changelog.","how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get participants-database --field=version. Affected if 2.7.8.5 or older.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.7.8.5"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2966,"output_tokens":430,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources list no fixed version and tag no-patch; confirm whether a patched release exists at https://nvd.nist.gov/vuln/detail/CVE-2026-112860 and the plugin's WordPress.org changelog.","search":"'-112860':12A,15A '-2026':11A,14A '2.7.8.5':48B,103C 'accord':67B 'affect':97C 'allow':92C 'attack':50B 'blind':41B,93C 'command':80C 'craft':61B 'cve':10A,13A 'data':53B 'databas':3A,9A,25B,32B,58B,88C,91C,99C 'database':18A 'element':75C 'expos':7A 'flaw':44B 'improp':71C 'inject':6A,28B,43B,82C 'injection.this':95C 'issu':96C 'login':65B 'n/a':101C 'need':66B 'neutral':72C 'no-patch':19B 'packag':22B 'particip':2A,24B,31B,87C,90C,98C 'participants':17A 'participants-databas':23B,89C 'participants-database':16A 'patch':21B 'plugin':35B 'read':52B 'request':62B 'send':60B 'site':8A,56B 'special':74C 'sql':5A,27B,42B,79C,81C,94C 'sql-inject':26B 'tag':70B 'unauthent':4A,29B 'use':76C 'version':46B 'vulner':83C 'webdesign':38B,86C 'wordpress':1A,30B,34B 'xnau':37B,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112860","severity":null,"published_at":"2026-10-23T09:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112860:176","url":null,"severity":null,"published_at":"2026-10-23T22:11:23+00:00","modified_at":"2026-10-23T22:11:23+00:00","first_seen_at":"2026-10-23T22:11:23+00:00","fetched_at":"2026-10-23T22:11:23+00:00","note":"Read Patchstack advisory, NVD and the WordPress.org plugin page. Patchstack marks the flaw unauthenticated, and no patch exists. The plugin is closed on WordPress.org since Oct 19. Not found exploited and no PoC. Did not search social posts, since the CVE is hours old. Fix field is unknown/none; check the plugin page for a new release."},{"source":"analyst","external_id":"CVE-2026-112860:263","url":null,"severity":null,"published_at":"2026-10-23T22:37:15+00:00","modified_at":"2026-10-23T22:37:15+00:00","first_seen_at":"2026-10-23T22:37:15+00:00","fetched_at":"2026-10-23T22:37:15+00:00","note":"Re-checked: no patched release. WordPress.org page still shows closed since Oct 19 with latest 2.7.8.5, and the tag mirror lists no tag after 2.7.8.5 (Jul 31). Added WPScan page for an earlier, different SQLi (CVE-2026-13596, fixed in 2.7.8.4) that has a public PoC. That is a sibling, not a PoC for this CVE, and it shows the same attack surface (list search) was hit before. Exploited stays false and no PoC for this CVE was found."},{"source":"epss","external_id":"CVE-2026-112860","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112860","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1317,"url":"https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-sql-injection-vulnerability","title":"Patchstack: Participants Database <= 2.7.8.5 SQL Injection (unauthenticated, no patch)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1318,"url":"https://wordpress.org/plugins/participants-database/","title":"Participants Database on wordpress.org (closed Oct 19, 2026)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1319,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112860","title":"NVD CVE-2026-112860","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1535,"url":"https://wpscan.com/vulnerability/e22227c8-506e-4188-a7a1-1952b41c47f5/","title":"WPScan: Participants Database < 2.7.8.4 unauthenticated SQLi via list search (earlier CVE-2026-13596, with PoC)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}