The vulnerability is an Insecure Direct Object Reference that allows an attacker to supply a user‑controlled key or identifier to access or modify participant records that are not normally visible to them. This mishandling of access control can lead to unauthorized read or write operations on sensitive data stored in the Participants Database, which compromises both confidentiality and integrity. The flaw is cataloged as CWE‑639 and carries a CVSS score of 6.3, indicating a moderate severity susceptibility.

The issue impacts the WordPress Participants Database plugin from its initial release through version 2.7.8.5 as distributed by xnau webdesign. Any site that has installed a vulnerable instance of this plugin is potentially exposed.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widely known exploitation at this time. Based on the description, the likely attack vector involves a user providing a crafted key or identifier via the plugin’s interface or URL, which the plugin then incorrectly trusts. The moderate CVSS rating reflects the risk of data exposure or alteration, but the absence of active exploitation data indicates a lower likelihood of immediate compromise. Site administrators should treat the vulnerability as an actionable risk and prioritize remediation.