What is the CVSS score of CVE-2026-32366?

CVE-2026-32366 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Collapsing Categories are affected by CVE-2026-32366?

A SQL injection vulnerability in the Collapsing Categories WordPress plugin (versions ≤3.0.9) allows attackers to extract sensitive database information through blind SQL injection attacks.

How to fix or mitigate CVE-2026-32366?

Within 24 hours: Disable the Collapsing Categories plugin immediately and assess which sites are running vulnerable versions ≤3.0.9. Within 7 days: Evaluate alternative category display solutions and plan plugin replacement; conduct database audit for unauthorized access indicators. Within 30 days: Complete migration to a patched or alternative solution, apply Web Application Firewall rules to block SQL injection patterns, and implement enhanced database monitoring and access controls.

Collapsing Categories CVE-2026-32366

EUVD-2026-11860 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Collapsing Categories

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11860

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.

AnalysisAI

A blind SQL injection vulnerability exists in the WordPress Collapsing Categories plugin (versions up to 3.0.9) that allows authenticated attackers with low privileges to execute arbitrary SQL queries against the database. The vulnerability enables extraction of sensitive data including user credentials, though it does not allow direct data modification. With a CVSS score of 8.5 and no current exploitation in the wild (not in KEV), this represents a serious but not critical risk for WordPress sites using this plugin.

Technical ContextAI

The Collapsing Categories plugin by robfelty is a WordPress extension that provides collapsible category listings for posts. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), where user-supplied input is not properly sanitized before being incorporated into database queries. This classic SQL injection flaw allows attackers to inject malicious SQL code through plugin parameters, though the 'blind' nature means results must be inferred through timing or boolean-based responses rather than direct output. The affected product is identified as cpe:2.3:a:robfelty:collapsing-categories:*:*:*:*:*:wordpress:*:* covering all versions through 3.0.9.

RemediationAI

The primary remediation is to update the Collapsing Categories plugin to a version newer than 3.0.9 if available, or remove the plugin entirely if it is not actively used. As an immediate workaround, administrators should review and restrict user privileges to minimize the number of accounts that could exploit this vulnerability, ensuring only trusted users have contributor-level access or higher. Additionally, implementing a Web Application Firewall (WAF) with SQL injection protection rules can help block exploitation attempts while awaiting a patch. Monitor WordPress security advisories and the plugin's official repository for security updates.