Participants Database for WordPress lacks proper authorization checks in the ‘id’ parameter, allowing unauthenticated users to overwrite arbitrary participant records. By forging numeric IDs and manipulating email fields, an attacker can redirect the private record link to an attacker‑controlled address, granting full read and edit access to personally identifiable information such as names, emails, phone numbers, and other custom fields. This creates a direct path to sensitive data exposure and unauthorized account manipulation.

The vulnerability affects all versions of the Participants Database plugin up to and including 2.7.8.3 on WordPress sites. Administrators of WordPress sites that have installed this plugin before the update are at risk, regardless of whether the site is publicly facing or internal.

The CVSS score of 5.3 indicates moderate overall risk, and the EPSS score of less than 1% signals a low probability of current exploitation in the wild. The issue is not listed in the CISA KEV catalog. The attack vector is unauthenticated, requiring only the ability to send GET and POST requests to the site’s public URLs. An attacker can obtain a valid nonce via a normal GET request to a signup or record form, then craft an arbitrary id value. No elevated privileges or complex conditions are required.