CVE-2026-112862: Deserialization of Untrusted Data in xnau webdesign Participants Database

The vulnerability identified as CVE-2026-112862 affects the xnau webdesign Participants Database plugin through improper deserialization of untrusted data. This allows an attacker to inject malicious objects, resulting in remote code execution or other severe impacts. The affected versions include all releases from initial through 2.7.8.5. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to complete system compromise, including unauthorized data access, modification, and service disruption. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous in exposed environments.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected plugin, disable it if possible, or apply any vendor-recommended temporary mitigations once published.