The plugin contains a deserialization of untrusted data flaw that enables object injection. An attacker can craft input that is deserialized by the Participants Database plugin, potentially allowing execution of arbitrary PHP code and full compromise of the hosting server. The weakness is classified as CWE-502, which is a serious flaw that can lead to remote code execution when exploited.

The vulnerability affects the xnau webdesign Participants Database plugin, version 2.7.8.5 and all earlier releases.

The CVSS score of 9.8 indicates a very high impact and ease of exploitation. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the absence of a KEV listing does not reduce the inherent danger. Because the flaw involves deserialization of user-controlled data, the likely attack vector is a crafted HTTP request or form input that is processed by the plugin; an attacker without privileged access can still abuse this if the input is publicly reachable. Administrators should treat the flaw as a critical, publicly known remote code execution risk until a trustworthy patch is applied.