---
id: "CVE-2026-112862"
kind: "vulnerability"
aliases: ["CVE-2026-112862"]
title: "Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5"
severity: "critical"
cvss: 9.8
epss: 0.00313
exploited: false
status: "open"
category: "package"
products: [{"name": "participants-database", "fixed": [], "affected": "<= 2.7.8.5", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["no-patch", "object-injection", "package", "participants-database", "php", "unauthenticated", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-23T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112862", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:37:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112862", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Participants Database WordPress plugin: object injection via untrusted data, unpatched through 2.7.8.5

The Participants Database WordPress plugin (xnau webdesign) deserializes untrusted data, which allows PHP object injection. No login is needed (CVSS 9.8). Every version through 2.7.8.5 is affected and there is no fixed release. wordpress.org closed the plugin on 19 Oct 2026 pending a review. Whether the flaw leads to code execution depends on a usable gadget chain from other installed plugins or themes; the advisories don't say. Patchstack expects mass exploitation, but I found no confirmed exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:participants-database affected <= 2.7.8.5 fixed ?

## How to check

In WordPress admin, open Plugins and look for Participants Database. Or run: wp plugin list --name=participants-database --fields=name,version,status. Any version up to and including 2.7.8.5 is vulnerable, and 2.7.8.5 is the latest release.

## Fix

No patched version exists (unknown when one will ship). Deactivate and remove the plugin, or replace it with a maintained alternative. Export your data first. If you must keep it, restrict public access to the pages that use its forms and shortcodes, or use a WAF rule. Patchstack offers a mitigation rule. Watch the wordpress.org plugin page for a reopened release.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112862
- 2026-10-23T22:37:28+00:00 analyst — Patchstack (reported 31 Aug 2026 by Poystick, published 21 Oct) and CVE record: unauthenticated PHP object injection, all versions <= 2.7.8.5, no patched version. Plugin closed on wordpress.org 19 Oct 2026 pending review. No PoC or exploitation found; I did not search X or Bluesky. Sibling CVEs exist (CVE-2026-112860 SQLi, CVE-2026-112861 access control, same range).
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112862

## Documents

- [advisory] Patchstack: Participants Database <= 2.7.8.5 PHP Object Injection https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-php-object-injection-vulnerability
- [describes] CVE record CVE-2026-112862 https://www.cve.org/CVERecord?id=CVE-2026-112862
- [mitigation] Participants Database on wordpress.org (closed Oct 19, 2026) https://wordpress.org/plugins/participants-database/

## From the sources

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_