{"affected":[{"defaultStatus":"unaffected","product":"CatFolders","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.5.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-107786","cwes":["CWE-89"],"description":"The CatFolders  WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"}],"kev":null,"metrics":[],"modifiedAt":1793858429810,"publishedAt":1793858429810,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/"}],"remediation":[],"revision":"e7dca235d5934189d28f215041940eceae272dd389eb20ddfcd3db840e8cdb81","sources":[{"modifiedAt":1793858429810,"name":"CNA: WPScan","retrievedAt":1793858912196,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107786"}],"ssvc":null,"status":"published","title":"CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting","updatedAt":1793858912196}