CVE-2026-32366: 
WordPress vulnerability analysis and mitigation

CVE-2026-32366 is a Blind SQL Injection vulnerability in the Collapsing Categories WordPress plugin by robfelty, affecting all versions through 3.0.9. The flaw stems from improper neutralization of special elements used in SQL commands (CWE-89), allowing authenticated attackers with low privileges to extract sensitive database contents. It was reported by Doan Dinh Van on January 17, 2026, and published by Patchstack on February 16, 2026. The vulnerability carries a CVSS v3.1 base score of 8.5 (High) (Patchstack, Feedly).

The vulnerability is classified as CWE-89 (SQL Injection) and specifically enables Blind SQL Injection, meaning the attacker infers database contents through boolean-based or time-based response differences rather than direct output. The attack vector is network-accessible, requires low privileges (Contributor or Developer role), and no user interaction. The changed scope indicates the impact can extend beyond the plugin itself to the underlying WordPress database. No detailed technical write-up or public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an authenticated attacker to perform blind SQL injection against the WordPress database, resulting in high confidentiality impact — including potential exposure of user credentials, personal data, and site configuration — and low availability impact due to possible database disruption. The changed scope means the vulnerability can affect resources beyond the plugin's own data boundary, potentially exposing the entire WordPress database. Integrity is not directly impacted based on the current CVSS assessment (Patchstack, Feedly).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the latest update. The EPSS score is approximately 0.021% (0.000210), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited imminently, though SQL injection vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Collapsing Categories plugin version ≤ 3.0.9 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain low-privilege access: Authenticate to the WordPress site with at least Contributor or Developer-level credentials, which are the minimum required privileges for exploitation.
3. Identify injectable parameter: Locate the plugin's functionality that interacts with the database (e.g., category listing or filtering parameters) and test for SQL injection susceptibility by injecting boolean payloads (e.g., ' AND 1=1-- vs. ' AND 1=2--) and observing response differences.
4. Execute blind SQL injection: Use automated tools such as sqlmap with session cookies to enumerate the database schema, extract table contents (e.g., wp_users), and retrieve password hashes and other sensitive data via boolean-based or time-based blind techniques.
5. Leverage extracted data: Use recovered credentials or sensitive information for further access, privilege escalation, or lateral movement within the hosting environment (Patchstack).

• Network: Unusual or repeated HTTP requests to WordPress endpoints associated with the Collapsing Categories plugin containing SQL metacharacters (e.g., single quotes, AND, OR, SLEEP, BENCHMARK) in query parameters.
• Logs: WordPress or web server access logs showing high volumes of requests to plugin-related endpoints from a single authenticated session; database error messages logged in debug.log related to malformed SQL queries.
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs, particularly time-delayed queries (SLEEP(), BENCHMARK()) or boolean-based conditional queries targeting wp_users or other sensitive tables.
• Process: Unusual database load spikes correlating with authenticated low-privilege user sessions (Feedly).

The patched version is 3.0.12, which resolves the SQL injection vulnerability — users should update the Collapsing Categories plugin immediately from the WordPress plugin repository (Patchstack). Patchstack users can enable auto-update for vulnerable plugins as an interim measure. Additional hardening steps include: implementing a Web Application Firewall (WAF) with SQL injection detection rules, applying the principle of least privilege to database users, reviewing and restricting Contributor/Developer role assignments, and monitoring database logs for anomalous query patterns.

The vulnerability was noted in automated CVE tracking feeds and briefly discussed on Bluesky via CVE alert accounts. The Hacker Wire published a brief coverage article on the vulnerability. Overall community reaction has been minimal, consistent with Patchstack's low-priority classification and the absence of active exploitation (Feedly).