CVE-2024-43141 CRITICAL

CVE-2024-43141: WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability

Vendor Roland Barker, Xnau Webdesign
Product Participants Database
Weakness CWE-502 · Unsafe deserialization
Published August 13, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.

Explanation of Vulnerability in Simple Terms

02Summary

Participants Database versions up to 2.5.9.2 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on the site. The vulnerability exists in how the plugin processes untrusted serialized data without proper validation. An attacker can exploit this remotely without user interaction to gain full control of the site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site and take complete control without needing a user account.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can steal data, modify content, install malware, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 13, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability CVE-2026-39498 WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field CVE-2026-39471 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability CVE-2026-3328 Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts