CVE-2026-107786
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query. This allows authenticated users with upload capability (Author and above) to perform SQL injection attacks.
Risk Assessment
Attackers can read or modify database data, potentially leading to data leakage and site compromise.
Recommendation
Update the CatFolders plugin to version 2.5.7 or later.
Other vulnerabilities in CatFolders
See all- CVE-2026-107787Low
The CatFolders WordPress plugin before 2.5.7 does not have authorization checks on a folder maintenance action. This allows users with a role as low as Subscriber to reset the per-user ownership of every media folder and disable the plugin's user restriction setting.
- CVE-2025-66120Medium
Missing Authorization vulnerability in CatFolders (WordPress plugin) in versions up to 2.5.3. Allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS