A user‑supplied parameter is used directly in a database query without proper sanitation. This flaw enables unauthenticated attackers to inject arbitrary SQL commands, potentially exposing sensitive data, modifying records, and compromising database integrity. The weakness aligns with standard SQL injection vulnerabilities (CWE‑89).

WordPress sites running Participants Database plugin version lower than 2.7.8.4 on any supported WordPress environment.

The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.1 describes a critical severity. However, because the attack does not require authentication, an attacker can target any public WordPress installation hosting the affected plugin, potentially executing queries directly against the site’s database. The exploitation path is straightforward: send a crafted request to the vulnerable list search endpoint to inject SQL. Findings in the CVE description confirm the presence of the flaw without additional prerequisites.