CVE-2026-107786: CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting

Q: Who can exploit this vulnerability?

An authenticated WordPress user with upload capability can exploit it. This includes Author-level users and higher-privileged roles.

Q: What attacker access is required?

The attacker must be able to authenticate to the WordPress site and control the sortFile setting used by the plugin. The issue is not described as exploitable by unauthenticated visitors.

Q: Which plugin versions are affected?

CatFolders versions before 2.5.7 are affected. Updating to version 2.5.7 or later addresses the vulnerable version range described.

Published Nov 5, 2026

Updated

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated WordPress user with upload capability can exploit it. This includes Author-level users and higher-privileged roles.

What attacker access is required?

The attacker must be able to authenticate to the WordPress site and control the sortFile setting used by the plugin. The issue is not described as exploitable by unauthenticated visitors.

Which plugin versions are affected?

CatFolders versions before 2.5.7 are affected. Updating to version 2.5.7 or later addresses the vulnerable version range described.

CVE-2026-107786: CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What attacker access is required?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What attacker access is required?

Which plugin versions are affected?