CVE-2026-13596 is a SQL injection vulnerability (CWE-89) in the Participants Database WordPress plugin versions prior to 2.7.8.4. The plugin fails to properly sanitize and escape user input before including it in SQL queries, enabling unauthenticated attackers to perform SQL injection attacks. This can result in unauthorized disclosure and modification of data. The vulnerability is publicly known and assigned a critical CVSS score of 9.1, but no vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized access to sensitive data and modification of database contents, severely impacting confidentiality and integrity. Availability impact is not indicated. The critical CVSS score reflects the high risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to it to trusted users only. Monitor official Participants Database plugin channels for updates and apply patches promptly once released.