{"id":"CVE-2026-107786","kind":"vulnerability","aliases":["CVE-2026-107786"],"related":[],"title":"CatFolders WordPress plugin: sort setting enables SQL injection by authors","description":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","summary":"The CatFolders WordPress plugin before 2.5.7 passes a user-controlled sort setting into a SQL query without sanitizing it. An authenticated user with upload capability, such as an Author, can inject SQL to read or alter site database contents.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["catfolders","package","self-hosted","wordpress"],"not_affected_if":["no-author-accounts","plugin-2.5.7-or-later","plugin-not-installed"],"how_to_check":"- Check the installed CatFolders plugin version in the WordPress admin Plugins screen or `wp plugin get catfolders --field=version`\n- Review which accounts hold the Author role or higher on the site","fix":"- CatFolders plugin: `2.5.7` or later (per the CVE description, versions before 2.5.7 are affected)","status":"open","published_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:15+00:00","updated_at":"2026-11-05T06:33:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:15Z","model":"claude-haiku-5-5","output":{"fix":"- CatFolders plugin: `2.5.7` or later (per the CVE description, versions before 2.5.7 are affected)","reach":"internet","title":"CatFolders WordPress plugin: sort setting enables SQL injection by authors","impact":"high","summary":"The CatFolders WordPress plugin before 2.5.7 passes a user-controlled sort setting into a SQL query without sanitizing it. An authenticated user with upload capability, such as an Author, can inject SQL to read or alter site database contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","catfolders","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated author reads or alters the WordPress database","analyst_note":"","how_to_check":"- Check the installed CatFolders plugin version in the WordPress admin Plugins screen or `wp plugin get catfolders --field=version`\n- Review which accounts hold the Author role or higher on the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.5.7-or-later","no-author-accounts"],"who_is_affected":"Sites running the CatFolders WordPress plugin before 2.5.7 where users with upload capability (Author and above) can log in. Sites without the plugin, or where only administrators and trusted editors have accounts, have a smaller exposure. The description does not say whether the flaw is reachable with default plugin settings.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4207,"output_tokens":560,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107786':13A,16A '-2026':12A,15A '2.5.7':28B,68C 'allow':88C 'alter':59B 'attack':101C 'authent':44B,89C 'author':10A,52B,94C 'capabl':48B,93C 'catfold':1A,17B,24B,64C 'content':62B 'control':33B,78C 'cve':11A,14A 'databas':61B 'enabl':6A 'escap':74C 'host':21B 'inject':8A,54B,100C 'packag':18B 'pass':29B 'perform':98C 'plugin':3A,26B,66C 'proper':71C 'queri':39B,87C 'read':57B 'sanit':41B,72C 'self':20B 'self-host':19B 'set':5A,35B,80C 'site':60B 'sort':4A,34B,79C 'sql':7A,38B,55B,86C,99C 'upload':47B,92C 'use':82C 'user':32B,45B,77C,90C 'user-control':31B,76C 'without':40B 'wordpress':2A,22B,25B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CatFolders WordPress plugin before 2.5.7 where users with upload capability (Author and above) can log in. Sites without the plugin, or where only administrators and trusted editors have accounts, have a smaller exposure. The description does not say whether the flaw is reachable with default plugin settings.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["catfolders","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107786","severity":null,"published_at":"2026-11-05T06:17:07+00:00","modified_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}