PT-2026-71533

CVE-2026-28189

·

Published

2026-08-13

·

Updated

2026-10-23

Description by

CVSS 3.1
7.4
High
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.5
Description The Participants Database plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation, which can lead to remote code execution if critical files, such as wp-config.php, are deleted.
Recommendations Update the plugin to a version newer than 2.7.8.4.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2026-28189
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com