Description
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
Published: 2026-08-13
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to delete arbitrary files on the server hosting a WordPress site that uses the Participants Database plugin. By sending a crafted HTTP request, the attacker can remove critical files, potentially disrupting website functionality or deleting sensitive data. The flaw falls under input path traversal (CWE-22) and compromises the integrity and availability of the affected platform.

Affected Systems

WordPress participants Database plugin, vendor Roland Barker, versions up to and including 2.7.8.4 are vulnerable.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity. The EPSS score is not provided but the vulnerability is unauthenticated, meaning any user of the site’s front‑end can trigger the deletion by accessing the problematic endpoint. The issue is not currently listed in the CISA KEV catalog. The attack vector is remote and does not require prior authentication; an attacker can simply send the request to the vulnerable plugin’s file deletion endpoint.

Generated by OpenCVE AI on August 13, 2026 at 15:57 UTC.

Remediation

Vendor Solution

Update the WordPress Participants Database plugin to the latest available version (at least 2.7.8.5).

OpenCVE Recommended Actions

  • Upgrade the WordPress Participants Database plugin to version 2.7.8.5 or newer.
  • Verify that only authorized users can invoke file delete operations, adjusting capability checks or adding role restrictions if necessary.
  • Restrict file system permissions for critical directories to reduce the impact of any remaining vulnerabilities.

Generated by OpenCVE AI on August 13, 2026 at 15:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Rolandbarkerxnauwebdesign
Rolandbarkerxnauwebdesign participants Database
Wordpress
Wordpress wordpress
Vendors & Products Rolandbarkerxnauwebdesign
Rolandbarkerxnauwebdesign participants Database
Wordpress
Wordpress wordpress

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
Title WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H'}

Subscriptions

Rolandbarkerxnauwebdesign Participants Database
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-13T15:25:23.043Z

Reserved: 2026-02-25T12:14:47.651Z

Link: CVE-2026-28189

cve-icon Vulnrichment

Updated: 2026-08-13T15:25:18.444Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T14:17:01.020

Modified: 2026-08-14T19:09:20.713

Link: CVE-2026-28189

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T12:15:36Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')