CatFolders – WP Media Folders, CVE-2026-107786
- CVE, Research URL
- Home page URL
- Application
- Published on
- Nov 05, 2026
- Research Description
- The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
- Affected versions
-
max 2.5.7.
- Status
-
vulnerable