CVE-2023-48751 MEDIUM

CVE-2023-48751: WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

Vendor Roland Barker, Xnau Webdesign
Product Participants Database
Weakness CWE-862 · Missing authorization
Published December 18, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.

Key dates

02Disclosure timeline

December 18, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12849 Contest Gallery <= 28.0.2 - Missing Authorization CVE-2025-14880 Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification CVE-2024-1218 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization CVE-2026-26207 DIscourse's discourse-policy plugin lacks post access check CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro