---
id: "CVE-2026-112860"
kind: "vulnerability"
aliases: ["CVE-2026-112860"]
title: "WordPress Participants Database: unauthenticated SQL injection exposes site database"
severity: "critical"
cvss: 9.3
epss: 0.00236
exploited: false
status: "open"
category: "package"
products: [{"name": "participants-database", "fixed": [], "affected": "<= 2.7.8.5", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["no-patch", "package", "participants-database", "sql-injection", "unauthenticated", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-above-2.7.8.5"]
published_at: "2026-10-23T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112860", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:11:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:37:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112860", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WordPress Participants Database: unauthenticated SQL injection exposes site database

Participants Database, a WordPress plugin by xnau webdesign, has a blind SQL injection flaw in versions through 2.7.8.5. An attacker can read data from the site's database by sending crafted requests, with no login needed according to the tags.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:participants-database affected <= 2.7.8.5 fixed ?

## How to check

Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get participants-database --field=version. Affected if 2.7.8.5 or older.

## Fix

No fixed version as of 2026-10-23: 2.7.8.5 is the latest and WordPress.org has closed the plugin. Deactivate and remove it, or block public access to pages with the [pdb_list] shortcode, until a release newer than 2.7.8.5 appears. Patchstack offers a virtual-patch rule.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112860
- 2026-10-23T22:11:23+00:00 analyst — Read Patchstack advisory, NVD and the WordPress.org plugin page. Patchstack marks the flaw unauthenticated, and no patch exists. The plugin is closed on WordPress.org since Oct 19. Not found exploited and no PoC. Did not search social posts, since the CVE is hours old. Fix field is unknown/none; check the plugin page for a new release.
- 2026-10-23T22:37:15+00:00 analyst — Re-checked: no patched release. WordPress.org page still shows closed since Oct 19 with latest 2.7.8.5, and the tag mirror lists no tag after 2.7.8.5 (Jul 31). Added WPScan page for an earlier, different SQLi (CVE-2026-13596, fixed in 2.7.8.4) that has a public PoC. That is a sibling, not a PoC for this CVE, and it shows the same attack surface (list search) was hit before. Exploited stays false and no PoC for this CVE was found.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112860

## Documents

- [advisory] Patchstack: Participants Database <= 2.7.8.5 SQL Injection (unauthenticated, no patch) https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-sql-injection-vulnerability
- [describes] NVD CVE-2026-112860 https://nvd.nist.gov/vuln/detail/CVE-2026-112860
- [mentions] WPScan: Participants Database < 2.7.8.4 unauthenticated SQLi via list search (earlier CVE-2026-13596, with PoC) https://wpscan.com/vulnerability/e22227c8-506e-4188-a7a1-1952b41c47f5/
- [mitigation] Participants Database on wordpress.org (closed Oct 19, 2026) https://wordpress.org/plugins/participants-database/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_