Sensitive Information Exposure in Participants Database Plugin for WordPress

CVE-2026-11354

What is CVE-2026-11354?

The Participants Database plugin for WordPress is susceptible to a significant security flaw that allows unauthenticated attackers to overwrite participant records using the 'id' parameter. This vulnerability grants attackers the ability to redirect access links containing sensitive participant information, such as names, email addresses, and phone numbers, to their controlled email accounts. By exploiting these weaknesses, attackers can perform a sequence of actions where they first collect a valid nonce through unauthenticated requests. They can then execute an update with an arbitrary ID to replace existing records. Eventually, triggering the retrieval action sends access links directly to the attacker's inbox, compromising the personal information stored in the participant database.

References