# CVE-2026-11354: xnau Participants Database sensitive information exposure via id parameter

Source: https://junglewise.ai/threats/cve-2026-11354-xnau-participants-database-sensitive-information-exposure-via-id  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-11354 · Severity: medium · CVSS 5.3 · Published 2026-07-24

The Participants Database plugin for WordPress, which is used to manage and store lists of individuals, contains a security flaw that allows unauthorized access to personal data. An attacker can manipulate the system to overwrite existing records and redirect access links to their own email address. This could lead to the exposure of sensitive information such as names, phone numbers, and email addresses of everyone in the database.

## Quick answers

**Is CVE-2026-11354 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11354 being exploited in the wild.

**How severe is CVE-2026-11354?** Medium severity, with a CVSS score of 5.3, published 24 July 2026.

**Which products and versions are affected?** xnau Participants Database up to, and including, 2.7.8.3.

**Is there a fix for CVE-2026-11354?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11354 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11354?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Participants Database plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its record update and retrieval logic. An unauthenticated attacker can obtain a valid nonce from any page displaying a public signup or record form. By sending a crafted POST request with the 'action=update' parameter and a specific numeric 'id', the attacker can overwrite a victim's record and change the associated email address. Subsequently, using 'action=retrieve' allows the attacker to receive a private access link at their controlled email address, granting full read and edit permissions for the victim's PII. The vulnerability is present in all versions up to and including 2.7.8.3.

## Affected products

- xnau Participants Database up to, and including, 2.7.8.3

## Timeline

- 2026-07-24: disclosed: Vulnerability published by Wordfence and NVD.

## References

- [https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_Shortcode.php](https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_Shortcode.php)
- [https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_submission/main_query/update_query.php](https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_submission/main_query/update_query.php)
- [https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php](https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php)
- [https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php](https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3606851%40participants-database&new=3606851%40participants-database](https://plugins.trac.wordpress.org/changeset?reponame=&old=3606851%40participants-database&new=3606851%40participants-database)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=cve)