Unauthenticated File Deletion in Participants Database Plugin by WordPress
CVE-2026-28189

7.4HIGH

Key Information:

Vendor

WordPress
Status
Participants Database
Vendor
CVE Published:
13 August 2026

What is CVE-2026-28189?

A security vulnerability has been identified in the Participants Database plugin for WordPress, allowing unauthenticated users to execute arbitrary file deletions. This issue affects all versions up to 2.7.8.4, potentially leading to unauthorized manipulation or loss of critical files on the server. It is essential for users to apply security measures or updates to safeguard their installations from such unauthorized actions.

Affected Version(s)

Participants Database <= 2.7.8.4

References

https://patchstack.com/database/wordpress/plugin/particip...
vdb-entry

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VanTastic | Patchstack Bug Bounty Program
.