How do I check whether I am affected by CVE-2026-112862?

In WordPress admin, open Plugins and look for Participants Database. Or run: wp plugin list --name=participants-database --fields=name,version,status. Any version up to and including 2.7.8.5 is vulnerable, and 2.7.8.5 is the latest release.

What is the fix for CVE-2026-112862?

No patched version exists (unknown when one will ship). Deactivate and remove the plugin, or replace it with a maintained alternative. Export your data first. If you must keep it, restrict public access to the pages that use its forms and shortcodes, or use a WAF rule. Patchstack offers a mitigation rule. Watch the wordpress.org plugin page for a reopened release.

Who is not affected by CVE-2026-112862?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-112862

Go to dashboard

critical9.8Packagewordpress

Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5

The Participants Database WordPress plugin (xnau webdesign) deserializes untrusted data, which allows PHP object injection. No login is needed (CVSS 9.8). Every version through 2.7.8.5 is affected and there is no fixed release. wordpress.org closed the plugin on 19 Oct 2026 pending a review. Whether the flaw leads to code execution depends on a usable gadget chain from other installed plugins or themes; the advisories don't say. Patchstack expects mass exploitation, but I found no confirmed exploitation or public PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker-controlled PHP objects may be injected into the server.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-112862

Go to dashboard

critical9.8Packagewordpress

Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker-controlled PHP objects may be injected into the server.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources