Executive brief
The Participants Database plugin for WordPress, which is used to manage and store lists of individuals, contains a security flaw that allows unauthorized access to personal data. An attacker can manipulate the system to overwrite existing records and redirect access links to their own email address. This could lead to the exposure of sensitive information such as names, phone numbers, and email addresses of everyone in the database.
Technical details
The Participants Database plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its record update and retrieval logic. An unauthenticated attacker can obtain a valid nonce from any page displaying a public signup or record form. By sending a crafted POST request with the 'action=update' parameter and a specific numeric 'id', the attacker can overwrite a victim's record and change the associated email address. Subsequently, using 'action=retrieve' allows the attacker to receive a private access link at their controlled email address, granting full read and edit permissions for the victim's PII. The vulnerability is present in all versions up to and including 2.7.8.3.
Affected products
- xnau Participants Database up to, and including, 2.7.8.3
Timeline
- 2026-07-24: disclosed: Vulnerability published by Wordfence and NVD.
References
- https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_Shortcode.php
- https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_submission/main_query/update_query.php
- https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php
- https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3606851%40participants-database&new=3606851%40participants-database
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=cve