Overview
CVE-2026-112862 is a deserialization of untrusted data vulnerability in the Participants Database WordPress plugin from xnau webdesign, resulting in PHP object injection. The CVE record scores it CVSS 9.8 (critical) with a network attack vector, low complexity, and no privileges or user interaction required. It was published on October 23, 2026, following a Patchstack report.
It was disclosed alongside CVE-2026-112860, a blind SQL injection in the same plugin.
Affected Products
| Component | Affected | Fixed |
|---|---|---|
| Participants Database (WordPress plugin) | 2.7.8.5 and earlier | Not confirmed at time of writing |
Technical Details
- Attacker-controlled data reaches PHP deserialization, letting an attacker instantiate arbitrary objects present in the application.
- Impact depends on the available gadget chains in WordPress core, the plugin, or other installed plugins. With a usable chain, this can lead to file operations or remote code execution.
- VulDB reports that no technical details or public exploit are available, and the flaw is not in CISA's KEV catalog.
- Third-party analyses score the issue lower than the CVE record, so treat the 9.8 as a worst case that depends on gadget availability.
Mitigation
- Check the plugin changelog and the Patchstack advisory for a release newer than 2.7.8.5, and update immediately when one ships.
- If no fix is available, deactivate the plugin or block public access to its endpoints.
- Remove unused plugins and themes to reduce available gadget chains.
- Monitor web logs for requests containing serialized PHP payloads (strings beginning with
O:ora:) sent to the plugin. - Keep a WAF in front of public WordPress sites.