CVE-2026-107786— CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting
Quick assessment
Affected
Unknown CatFolders
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.5.7 版本之前，CatFolders WordPress 插件未对用户可控的排序设置进行适当的清理和转义，便将其用于 SQL 查询中。这使得拥有上传权限的已认证用户（作者及以上角色）能够发起 SQL 注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | CatFolders | < 2.5.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107786
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting
Source: CVE Program / CVE List V5
Vulnerability Description
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | CatFolders | 0 ~ 2.5.7 | - |
|
II. Public POCs for CVE-2026-107786
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107786
请登录查看更多情报信息。
Other References for CVE-2026-107786 (1)
-
https://wpscan.com/vulnerability/6f6bdea1-b848-4deb-aac4-7e04bfcb2d87/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-05 · 29 CVEs total
| CVE-2026-107776 | 2.2 LOW | Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coup |
| CVE-2026-90963 | Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Con | |
| CVE-2026-16304 | WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids | |
| CVE-2026-85347 | FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption | |
| CVE-2026-85351 | FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import | |
| CVE-2026-85346 | FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Hand | |
| CVE-2026-19256 | All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Forc | |
| CVE-2026-86442 | WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR | |
| CVE-2026-86795 | Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_ | |
| CVE-2026-85570 | Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure | |
| CVE-2026-87856 | Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restricti | |
| CVE-2026-88814 | YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending v | |
| CVE-2026-90964 | Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending | |
| CVE-2026-90966 | Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Pai | |
| CVE-2026-90965 | Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure | |
| CVE-2025-15701 | Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings | |
| CVE-2025-15702 | Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS | |
| CVE-2026-91049 | EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attrib | |
| CVE-2026-90967 | Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR | |
| CVE-2026-100144 | IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-107776
Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Wit -
CVE-2026-100109
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated P -
CVE-2026-109150
WP PageNavi Style <= 1.4 - Stored XSS via CSRF -
CVE-2026-107787
CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and -
CVE-2026-105259
Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Uploa