An unauthenticated SQL injection vulnerability in the Participants Database plugin for WordPress allows attackers to extract sensitive data from the database.

The plugin fails to properly sanitize user-supplied input before using it in database queries, allowing an unauthenticated attacker to inject malicious SQL commands. This flaw occurs within the plugin's core functionality, enabling unauthorized database interaction.

Successful exploitation allows an attacker to bypass authentication and access, modify, or delete sensitive data stored in the WordPress database. With a CVSS score of 9.3, this represents a major risk to data integrity and privacy, which could lead to significant regulatory and reputational consequences for the organization.

Immediate Action: Update the Participants Database plugin to version 2.7.8.4 or higher immediately to patch the injection vulnerability.

Proactive Monitoring: Monitor database query logs for anomalous syntax or unexpected access patterns that deviate from standard plugin behavior.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection patterns until the plugin can be updated.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for total data exposure, users must apply the available patch immediately. If an update cannot be performed, consider disabling the plugin entirely until the security risk is mitigated.