{"id":"CVE-2026-112861","kind":"vulnerability","aliases":["CVE-2026-112861"],"related":[],"title":"Participants Database WordPress plugin: authorization bypass through user-controlled key","description":"Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.","summary":"The Participants Database WordPress plugin by xnau webdesign has an authorization bypass where a user-controlled key defeats access control settings. An attacker can reach participant records or actions their role should not allow.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","participants-database","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or the `participants-database` plugin header; the sources say the flaw affects versions through `2.7.8.5`.\n- Review the plugin's access control security level settings for participant data.","fix":"- Update the Participants Database plugin to a version newer than `2.7.8.5`; the sources do not name the exact fixed release, so check the plugin's changelog.","status":"open","published_at":"2026-10-20T18:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:01:36+00:00","updated_at":"2026-10-25T04:01:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:01:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Participants Database plugin to a version newer than `2.7.8.5`; the sources do not name the exact fixed release, so check the plugin's changelog.","reach":"internet","title":"Participants Database WordPress plugin: authorization bypass through user-controlled key","impact":"medium","summary":"The Participants Database WordPress plugin by xnau webdesign has an authorization bypass where a user-controlled key defeats access control settings. An attacker can reach participant records or actions their role should not allow.","category":"package","nicknames":[],"who_cares":["wordpress","participants-database","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads or changes participant records beyond their role's permissions.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and whether unauthenticated access is possible.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or the `participants-database` plugin header; the sources say the flaw affects versions through `2.7.8.5`.\n- Review the plugin's access control security level settings for participant data.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Participants Database plugin at version `2.7.8.5` or earlier that use its access control levels to limit what logged-in or other users can see or change. Sites without this plugin, or with it removed, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3308,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112861':14A,17A '-2026':13A,16A '2.7.8.5':92C 'access':45B,81C 'action':55B 'affect':86C 'allow':60B,77C 'attack':49B 'author':5A,36B,61C 'bypass':6A,37B,62C 'configur':80C 'control':10A,42B,46B,66C,82C 'cve':12A,15A 'databas':2A,21B,28B,73C,76C,88C 'defeat':44B 'exploit':78C 'host':24B 'incorrect':79C 'issu':85C 'key':11A,43B,67C 'levels.this':84C 'n/a':90C 'packag':18B 'particip':1A,20B,27B,52B,72C,75C,87C 'participants-databas':19B,74C 'plugin':4A,30B 'reach':51B 'record':53B 'role':57B 'secur':83C 'self':23B 'self-host':22B 'set':47B 'user':9A,41B,65C 'user-control':8A,40B,64C 'vulner':68C 'webdesign':33B,71C 'wordpress':3A,25B,29B 'xnau':32B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Participants Database plugin at version `2.7.8.5` or earlier that use its access control levels to limit what logged-in or other users can see or change. Sites without this plugin, or with it removed, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112861","severity":null,"published_at":"2026-10-20T18:17:18+00:00","modified_at":"2026-10-21T11:17:07+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}