{"id":"CVE-2026-112860","published":"2026-10-23T09:17:06.280","lastModified":"2026-10-23T16:06:31.143","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Blind SQL injection in Participants Database plugin allows unauthenticated attackers to infer database contents by observing timing or response differences, potentially exposing sensitive data.","exploitability":"Exploitation requires no authentication or user interaction and is feasible over the network due to lack of input sanitization.","blast_radius":"Successful exploitation could lead to full compromise of backend data integrity and confidentiality, including user credentials or personal information stored in the database.","remediation":"Upgrade to Participants Database version 2.7.8.6 or later, as this is the first fixed version following the affected range (n/a through 2.7.8.5).","detection":"Defenders should monitor web server access logs for anomalous SQL-like patterns in query parameters (e.g., 'AND SLEEP(', 'OR 1=1--'), or elevated latency in HTTP responses indicating time-based blind injection attempts.","tags":["sql-injection","blind-sqli","webapp","owasp-top10"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:49:01.465Z"}}