{"cve":"CVE-2026-107786","enrichment":{"created":"2026-11-05T07:30:14.786785+00:00","updated":"2026-11-05T07:30:14.786791+00:00","vendors":[],"weaknesses":["CWE-89"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:29.810000+00:00","description":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/107xxx/CVE-2026-107786.json","references":["https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"],"title":"CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting","updated":"2026-11-05T06:00:29.810000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:07.343000+00:00","description":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-107786.json","references":["https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"],"title":null,"updated":"2026-11-05T06:17:07.343000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","old":null},"type":"description"},{"details":{"new":"CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"],"removed":[]},"type":"references"}],"id":"048c7812-3a0f-4618-8504-287f60ed41aa"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-89"],"removed":[]},"type":"weaknesses"}],"id":"fdc76dd7-5ddb-44a2-80f5-359be86845a2"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:29.810000+00:00","provider":"mitre"},"description":{"data":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"],"providers":["mitre","nvd"]},"title":{"data":"CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.786791+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-89"],"providers":["enrichment"]}}}