Vulnerability record · CVE-2020-8596 · published 11 February 2020
CVE-2020-8596: Xnau participants database sql injection vulnerability
Xnau · Participants Database
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Description
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://blog.impenetrable.tech/cve-2020-8596 | Third Party Advisory |
| https://wpvulndb.com/vulnerabilities/10068 | Third Party Advisory |
| https://blog.impenetrable.tech/cve-2020-8596 | Third Party Advisory |
| https://wpvulndb.com/vulnerabilities/10068 | Third Party Advisory |
Track CVE-2020-8596 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8596), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
