CVE-2026-13596 PUBLISHED

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

Assigner: WPScan
Reserved: 29.06.2026 Published: 01.08.2026 Updated: 01.08.2026

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Participants Database
Versions Default: unaffected
  • affected from 0 to 2.7.8.4 (excl.)

Credits

  • João Ramos Maciel finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE