WordPress Plugin Vulnerabilities

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

Description

The plugin does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
participants-database
Fixed in 2.7.8.4

References

CVE
CVE-2026-13596

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
e22227c8-506e-4188-a7a1-1952b41c47f5

Timeline

Publicly Published
2026-07-20 (about 7 days ago)
Added
2026-07-20 (about 6 days ago)
Last Updated
2026-07-24 (about 2 days ago)

Other

Published
Title
Published
2024-10-25
Title
RSVP ME <= 1.9.9 - Unauthenticated SQL Injection
Published
2024-04-05
Title
LearnPress Export Import < 4.0.4 - Authenticated (Administrator+) SQL Injection
Published
2014-08-01
Title
WordPress 2.0.2 - 2.0.4 Paged Parameter SQL Injection
Published
2026-04-27
Title
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
Published
2024-03-28
Title
CRM Perks Forms < 1.1.5 - Unauthenticated SQL Injection