CVE-2026-112860: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in xnau webdesign Participants Database

The vulnerability identified as CVE-2026-112860 affects the Participants Database plugin by xnau webdesign. It is an improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. This vulnerability allows Blind SQL Injection attacks, which can be exploited remotely without authentication. The affected versions include all releases up to and including 2.7.8.5. The CVSS v3.1 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported. There is no information about an official patch or vendor advisory in the provided data.

An attacker can exploit this Blind SQL Injection vulnerability remotely without authentication to extract sensitive information from the database, leading to a high confidentiality impact. The vulnerability also has a low impact on availability but does not affect data integrity. No known exploits in the wild are reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewalls or other SQL injection mitigation techniques to reduce risk.