CVE-2014-3961

CVE-2014-3961 describes a critical SQL injection vulnerability in the Participants Database plugin for WordPress, specifically affecting versions prior to 1.5.4.9. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the 'query' parameter during an "output CSV" action on the pdb-signup/ page. With a CVSS score of 7.5, this vulnerability presents a high risk due to its network-based attack vector and low attack complexity, potentially leading to unauthorized data disclosure, modification, or denial of service. While not on CISA's KEV catalog, exploit code is publicly available via ExploitDB, though there is no evidence of widespread active exploitation or significant community discussion.