Object Injection Vulnerability in Participants Database by xnau webdesign
CVE-2026-112862

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Participants Database
Vendor
CVE Published:
23 October 2026

What is CVE-2026-112862?

The Participants Database plugin developed by xnau webdesign is vulnerable to an object injection issue due to the deserialization of untrusted data. This vulnerability could potentially allow attackers to execute arbitrary code by sending specially crafted input to the affected plugin, which spans multiple versions leading up to 2.7.8.5. Users are encouraged to apply necessary patches and updates to mitigate the risk associated with this vulnerability.

Affected Version(s)

Participants Database 0 <= 2.7.8.5

References

https://patchstack.com/database/wordpress/plugin/particip...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TarcĂ­sio Luchesi(Poystick) | Patchstack Bug Bounty Program
.