The vulnerability is a blind SQL injection flaw caused by improper neutralization of special elements in the database query construction of the Participants Database plugin. An attacker can send crafted input that alters the SQL command, enabling extraction of sensitive data or unauthorized manipulation of the database. No direct code execution is described, but the severity rating indicates a high impact on confidentiality and integrity.

All WordPress sites running the xnau webdesign Participants Database plugin up to and including version 2.7.8.5 are affected.

The CVSS score of 9.3 classifies the issue as critical. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the attack vector is likely a network-based HTTP request to the plugin’s input fields, allowing remote attackers to trigger blind injections without authentication if the plugin’s endpoints are exposed. The potential for data exfiltration or unauthorized database modifications makes the risk high.