ghsa-wvfh-22pv-4wc4

github
Description

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [],
  "aliases": [
    "CVE-2026-107786"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-05T06:17:07Z",
    "severity": null
  },
  "details": "The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.",
  "id": "GHSA-wvfh-22pv-4wc4",
  "modified": "2026-11-05T06:34:37Z",
  "published": "2026-11-05T06:34:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107786"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
View JSON API Download JSON