CVE-2026-112860

Summary

Blind SQL injection in Participants Database plugin allows unauthenticated attackers to infer database contents by observing timing or response differences, potentially exposing sensitive data.

Exploitability

Exploitation requires no authentication or user interaction and is feasible over the network due to lack of input sanitization.

Blast radius

Successful exploitation could lead to full compromise of backend data integrity and confidentiality, including user credentials or personal information stored in the database.

Detection

Defenders should monitor web server access logs for anomalous SQL-like patterns in query parameters (e.g., 'AND SLEEP(', 'OR 1=1--'), or elevated latency in HTTP responses indicating time-based blind injection attempts.

Prioritized remediation

Upgrade to Participants Database version 2.7.8.6 or later, as this is the first fixed version following the affected range (n/a through 2.7.8.5).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.