CVE-2026-112862

Summary

The Participants Database plugin for WordPress prior to version 2.7.8.6 contains a deserialization vulnerability (CWE-502) that allows attackers to inject and execute arbitrary PHP objects via untrusted serialized data, leading to full system compromise including remote code execution.

Exploitability

Exploitation is straightforward for an attacker with network access to the plugin's endpoints that accept serialized input; no authentication or user interaction is required due to CVSS metrics AV:N/AC:L/PR:N/UI:N.

Blast radius

Successful exploitation grants full confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling attackers to steal sensitive data, modify content, install backdoors, or take complete control of the WordPress site and potentially the underlying server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Participants Database version 2.7.8.6 or later, which contains the vendor's official fix for this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.