Live › vulnerability › CVE-2026-112861
Go to dashboardThe Participants Database WordPress plugin by xnau webdesign has an authorization bypass where a user-controlled key defeats access control settings. An attacker can reach participant records or actions their role should not allow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Participants Database plugin at version or earlier that use its access control levels to limit what logged-in or other users can see or change. Sites without this plugin, or with it removed, are not affected.
2.7.8.5No product ranges from the sources yet.
participants-database plugin header; the sources say the flaw affects versions through 2.7.8.5.2.7.8.5; the sources do not name the exact fixed release, so check the plugin's changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-112861")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.