Description

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-13T14:17:01.020Z",
  "pubdate": "2026-08-13T14:17:01.020Z",
  "executiveSummary": "An unauthenticated arbitrary file deletion vulnerability exists in the Participants Database plugin for versions <= 2.7.8.4.\nThis security flaw allows remote, unauthenticated attackers to delete arbitrary files on the underlying filesystem where the vulnerable application is hosted.\nThe vulnerability poses a severe risk to system integrity and availability, potentially leading to denial of service, data corruption, or application takeover by removing critical system, configuration, or core application files.\nThe attacker requires no prior authentication or privileged access to execute the exploit, relying solely on network accessibility to the vulnerable endpoint exposed by the Participants Database plugin.\nExploitation requirements are minimal, as the lack of proper input validation and authorization checks on the file deletion handler enables direct invocation by arbitrary external entities.\nRemediation requires updating the affected Participants Database plugin beyond version 2.7.8.4 to a patched release once available.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and a complete lack of authentication and authorization checks within the file deletion functionality of the Participants Database plugin for versions <= 2.7.8.4.\nThe vulnerable component processes user-supplied parameters intended to target specific files for deletion without verifying whether the issuing user possesses administrative privileges or a valid authenticated session.\nThe attack flow begins when an unauthenticated remote attacker sends a maliciously crafted HTTP request directly to the vulnerable endpoint responsible for handling file removal operations.\nBecause the application fails to validate the boundaries of the targeted file path or restrict access to authorized administrators, the request is processed directly by the underlying file manipulation functions.\nThe payload behavior involves specifying target file paths—potentially utilizing directory traversal sequences or absolute paths depending on the exact implementation of the input handler—causing the filesystem to delete the specified resources.\nThe network exposure is absolute for any web application instance running the affected versions of the Participants Database plugin, as the vulnerable endpoint is accessible over standard HTTP/HTTPS protocols without session validation.\nThe post-exploitation impact includes severe system instability, application crash, denial of service through the removal of core execution files, or the deletion of critical configuration files such as wp-config.php in a WordPress environment, which can facilitate further compromise."
}