CVE-2026-32366
Published: 13 March 2026
Summary
CVE-2026-32366 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires input validation to neutralize special elements in SQL commands, directly preventing blind SQL injection exploitation in the Collapsing Categories plugin.
SI-2 mandates timely identification, reporting, and remediation of flaws like this SQL injection vulnerability through plugin patching.
RA-5 employs vulnerability scanning to identify SQL injection flaws in web plugins such as Collapsing Categories, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Blind SQL injection (CWE-89) in the authenticated WordPress plugin context directly enables arbitrary database queries for data extraction (high confidentiality impact), mapping to the Databases sub-technique under Data from Information Repositories.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.
Deeper analysisAI
CVE-2026-32366 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), in the Collapsing Categories WordPress plugin developed by robfelty. The issue affects the collapsing-categories component in all versions from n/a through 3.0.9. It was published on 2026-03-13 with a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Low-privileged authenticated users (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation changes scope (S:C), enabling high confidentiality impact (C:H) through data extraction via blind SQL injection techniques, alongside low availability impact (A:L) and no integrity impact (I:N).
The Patchstack advisory provides details on this WordPress Collapsing Categories plugin 3.0.9 SQL injection vulnerability, including potential mitigation guidance: https://patchstack.com/database/Wordpress/Plugin/collapsing-categories/vulnerability/wordpress-collapsing-categories-plugin-3-0-9-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)