Overview
CVE-2026-112860 is a blind SQL injection vulnerability in the Participants Database WordPress plugin from xnau webdesign. The flaw is caused by improper neutralization of special elements used in an SQL command. It is rated CVSS 9.3 (critical) and was published on October 23, 2026, after being reported through Patchstack.
Participants Database is used to build and manage member, participant and registration records, so the underlying tables often hold personal information.
Affected Products
| Component | Affected | Fixed |
|---|---|---|
| Participants Database (WordPress plugin) | 2.7.8.5 and earlier | Not confirmed at time of writing |
Technical Details
- The issue is a blind SQL injection: attackers cannot read query output directly, but can infer data through boolean or time-based responses.
- Patchstack lists the required privilege level as "Developer", which suggests an authenticated, elevated account is needed rather than anonymous access.
- The vulnerability is not listed in CISA's KEV catalog and no public exploitation has been reported.
Impact
A successful attack could expose or alter data in the WordPress database, including participant records, user hashes and site configuration values.
Mitigation
- Check the plugin changelog and the Patchstack advisory for a release newer than 2.7.8.5, and update as soon as one is available.
- If no fix is available, deactivate the plugin or restrict access to its admin and shortcode endpoints.
- Audit accounts with elevated plugin or admin privileges and remove any you do not recognize.
- Review database and web server logs for unusually slow or repetitive requests to the plugin.
- Deploy a WAF rule set that covers SQL injection patterns on WordPress.