CVE-2026-11354

Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.4

Description The Participants Database plugin for WordPress allows unauthenticated attackers to expose sensitive information via the id parameter. By harvesting a valid nonce through a GET request to a page with a public signup or record form, an attacker can send a POST request with action=update and an arbitrary id value to overwrite participant records. By subsequently using action=retrieve, the attacker can redirect the record-access link to an email address they control, granting full read and edit access to personally identifiable information such as names, email addresses, and phone numbers.

Recommendations Update the plugin to a version newer than 2.7.8.3. As a temporary mitigation, restrict access to the id parameter in the affected plugin functions until the update is applied.