CVE-2026-13596

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

View on CVE.org
Published Aug 1, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Analysis

AI-generated

Technical impact

A user‑supplied parameter is used directly in a database query without proper sanitation. This flaw enables unauthenticated attackers to inject arbitrary SQL commands, potentially exposing sensitive data, modifying records, and compromising database integrity. The weakness aligns with standard SQL injection vulnerabilities (CWE‑89).

Affected Systems

WordPress sites running Participants Database plugin version lower than 2.7.8.4 on any supported WordPress environment.

Risk and Exploitability

The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.1 describes a critical severity. However, because the attack does not require authentication, an attacker can target any public WordPress installation hosting the affected plugin, potentially executing queries directly against the site’s database. The exploitation path is straightforward: send a crafted request to the vulnerable list search endpoint to inject SQL. Findings in the CVE description confirm the presence of the flaw without additional prerequisites.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Participants Database plugin to version 2.7.8.4 or newer to eliminate the injection vector.
  • Disable or restrict access to the list search functionality through access controls or by removing the search page until the patch is applied.
  • Deploy a Web Application Firewall or equivalent security ruleset to detect and block SQL injection attempts against the list search endpoint, and monitor logs for anomalous activity.

Generated by OpenCVE AI on August 4, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions participants Database
Vendors & Products Wordpress-extensions
Wordpress-extensions participants Database
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-89
Type Values Removed Values Added
Description The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
Title Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
References
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Aug 3, 2026, 6:51 PM
Reserved
Jun 29, 2026, 7:28 AM

View source JSON

Updated
Aug 3, 2026, 6:51 PM

JSON

Status
Deferred
Published
Aug 1, 2026, 7:16 AM
Modified
Aug 26, 2026, 4:31 PM

View source JSON

No data.

Updated
Nov 11, 2026, 9:42 AM

JSON