Executive brief
The Participants Database plugin for WordPress, which is used to manage and display lists of people or records, contains a security flaw that allows unauthorized individuals to manipulate database queries. By sending a specially crafted request to the site's list search feature, an attacker could potentially access sensitive information stored in the database or disrupt site operations. This vulnerability does not require the attacker to have an account or be logged in. Owners of websites using this plugin should update to version 2.7.8.4 or later immediately to protect their data.
Technical details
A SQL injection vulnerability exists in the Participants Database plugin for WordPress in versions prior to 2.7.8.4. The flaw is located within the list search functionality, where the plugin fails to properly sanitize and escape user-supplied parameters before incorporating them into a SQL query. An unauthenticated remote attacker can exploit this by sending a malicious request to the affected endpoint, allowing for the execution of arbitrary SQL commands. This could lead to unauthorized data extraction from the WordPress database. The issue is addressed in version 2.7.8.4.
Affected products
- Unknown Participants Database < 2.7.8.4
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Fixed in version 2.7.8.4
- 2026-08-01: advisory