Robert Hartinger

**Name of the Vulnerable Software and Affected Versions** Participants Database versions prior to 2.7.8.4 **Description** The Participants Database plugin for WordPress allows unauthenticated attackers to expose sensitive information via the `id` parameter. By harvesting a valid nonce through a GET request to a page with a public signup or record form, an attacker can send a POST request with `action=update` and an arbitrary `id` value to overwrite participant records. By subsequently using `action=retrieve`, the attacker can redirect the record-access link to an email address they control, granting full read and edit access to personally identifiable information such as names, email addresses, and phone numbers. **Recommendations** Update the plugin to a version newer than 2.7.8.3. As a temporary mitigation, restrict access to the `id` parameter in the affected plugin functions until the update is applied.