CVE-2026-11354

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.

• CWE-862

• https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_Shortcode.php#L1267
• https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/classes/PDb_submission/main_query/update_query.php#L57
• https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php#L1671
• https://plugins.trac.wordpress.org/browser/participants-database/tags/2.7.8.3/participants-database.php#L2437
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3606851%40participants-database&new=3606851%40participants-database
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=cve

Published

Jul 24, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113530After Effects is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113532After Effects is affected by an Improper Limitation of a Pat…8.6
• CVE-2026-113534After Effects is affected by an Improper Input Validation vu…8.6
• CVE-2026-113536After Effects is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113538After Effects is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113539Media Encoder is affected by a NULL Pointer Dereference vuln…5.5
• CVE-2026-113541Media Encoder is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113543Media Encoder is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113545Media Encoder is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113547Media Encoder is affected by an out-of-bounds write vulnerab…7.8
• CVE-2026-113549Audition is affected by a NULL Pointer Dereference vulnerabi…5.5
• CVE-2026-11355The DT LMS – elearning, WordPress LMS plugin for WordPress i…5.3