CVE-2026-11354 is a missing authorization vulnerability (CWE-862) in the xnau Participants Database WordPress plugin affecting all versions up to 2.7.8.3. It allows unauthenticated attackers to overwrite arbitrary participant records by numeric ID through the 'id' parameter. By harvesting a valid nonce from any page rendering the public signup or record form, attackers can send a POST request with action=update and an arbitrary id to overwrite records. Subsequently, using action=retrieve, attackers receive the private-access link redirected to an attacker-controlled email, enabling full read and edit access to the victim's personally identifiable information including names, emails, phone numbers, and other collected fields.

The vulnerability allows unauthorized modification and access to sensitive participant data stored in the database, including personally identifiable information. This exposure can lead to privacy violations and potential misuse of personal data. The CVSS score of 5.3 indicates a medium severity with no confidentiality impact but integrity impact due to unauthorized data modification. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Participants Database plugin and monitor for suspicious activity. Avoid exposing the plugin's public forms on untrusted networks. Follow vendor updates closely for an official patch or temporary mitigation.