{"id":"CVE-2026-112862","kind":"vulnerability","aliases":["CVE-2026-112862"],"related":[],"title":"Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5","description":"Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","summary":"The Participants Database WordPress plugin (xnau webdesign) deserializes untrusted data, which allows PHP object injection. No login is needed (CVSS 9.8). Every version through 2.7.8.5 is affected and there is no fixed release. wordpress.org closed the plugin on 19 Oct 2026 pending a review. Whether the flaw leads to code execution depends on a usable gadget chain from other installed plugins or themes; the advisories don't say. Patchstack expects mass exploitation, but I found no confirmed exploitation or public PoC.","severity":"critical","cvss":9.8,"epss":0.00313,"exploited":false,"exploited_at":null,"products":[{"name":"participants-database","fixed":[],"affected":"<= 2.7.8.5","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["no-patch","object-injection","package","participants-database","php","unauthenticated","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin, open Plugins and look for Participants Database. Or run: wp plugin list --name=participants-database --fields=name,version,status. Any version up to and including 2.7.8.5 is vulnerable, and 2.7.8.5 is the latest release.","fix":"No patched version exists (unknown when one will ship). Deactivate and remove the plugin, or replace it with a maintained alternative. Export your data first. If you must keep it, restrict public access to the pages that use its forms and shortcodes, or use a WAF rule. Patchstack offers a mitigation rule. Watch the wordpress.org plugin page for a reopened release.","status":"open","published_at":"2026-10-23T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:30+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5","impact":"high","summary":"The Participants Database WordPress plugin deserializes untrusted input, which allows PHP object injection. The NVD rates it 9.8 critical.","category":"package","who_cares":["wordpress","participants-database","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-controlled PHP objects may be injected into the server","analyst_note":"Find the first fixed plugin version and the attack preconditions at https://nvd.nist.gov/vuln/detail/CVE-2026-112862 or the plugin changelog.","how_to_check":"Check the installed Participants Database plugin version in WordPress admin under Plugins; versions 2.7.8.5 and earlier are affected.","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00099,"input_tokens":2892,"output_tokens":1402,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the first fixed plugin version and the attack preconditions at https://nvd.nist.gov/vuln/detail/CVE-2026-112862 or the plugin changelog.","search":"'-112862':15A,18A '-2026':14A,17A '19':73B '2.7.8.5':12A,59B,139C '2026':75B '9.8':55B 'advisori':99B 'affect':61B,133C 'allow':46B,129C 'chain':91B 'close':69B 'code':84B 'confirm':111B 'cve':13A,16A 'cvss':54B 'data':9A,44B,119C 'databas':2A,31B,37B,125C,128C,135C 'database':21A 'depend':86B 'deseri':42B,116C 'everi':56B 'execut':85B 'expect':104B 'exploit':106B,112B 'fix':66B 'flaw':81B 'found':109B 'gadget':90B 'inject':6A,27B,49B 'injection.this':131C 'instal':94B 'issu':132C 'lead':82B 'login':51B 'mass':105B 'n/a':137C 'need':53B 'no-patch':22B 'object':5A,26B,48B,130C 'object-inject':25B 'oct':74B 'packag':28B 'particip':1A,30B,36B,124C,127C,134C 'participants':20A 'participants-databas':29B,126C 'participants-database':19A 'patch':24B 'patchstack':103B 'pend':76B 'php':32B,47B 'plugin':4A,39B,71B,95B 'poc':115B 'public':114B 'releas':67B 'review':78B 'say':102B 'theme':97B 'unauthent':33B 'unpatch':10A 'untrust':8A,43B,118C 'usabl':89B 'version':57B 'via':7A 'vulner':120C 'webdesign':41B,123C 'whether':79B 'wordpress':3A,34B,38B 'wordpress.org':68B 'xnau':40B,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112862","severity":null,"published_at":"2026-10-23T09:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112862:262","url":null,"severity":null,"published_at":"2026-10-23T22:37:28+00:00","modified_at":"2026-10-23T22:37:28+00:00","first_seen_at":"2026-10-23T22:37:28+00:00","fetched_at":"2026-10-23T22:37:28+00:00","note":"Patchstack (reported 31 Aug 2026 by Poystick, published 21 Oct) and CVE record: unauthenticated PHP object injection, all versions <= 2.7.8.5, no patched version. Plugin closed on wordpress.org 19 Oct 2026 pending review. No PoC or exploitation found; I did not search X or Bluesky. Sibling CVEs exist (CVE-2026-112860 SQLi, CVE-2026-112861 access control, same range)."},{"source":"epss","external_id":"CVE-2026-112862","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112862","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1537,"url":"https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-php-object-injection-vulnerability","title":"Patchstack: Participants Database <= 2.7.8.5 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1318,"url":"https://wordpress.org/plugins/participants-database/","title":"Participants Database on wordpress.org (closed Oct 19, 2026)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1539,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112862","title":"CVE record CVE-2026-112862","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}