CatFolders vulnerabilities
CVEs whose affected-version data names the CatFolders package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107786Medium· 6.8CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL inje…
▾ SunlitEPSS 0.16%via CVEORG
CVE-2026-107787Low· 3.1CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFol…
▾ SunlitEPSS 0.13%via CVEORG