CVE-2025-9776

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9776", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-31T22:14:46.514Z", "datePublished": "2025-09-11T04:26:21.016Z", "dateUpdated": "2026-04-08T17:29:53.204Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:53.204Z"}, "affected": [{"vendor": "catfolders", "product": "CatFolders \u2013 WordPress Media Library Folders & Categories", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CatFolders \u2013 Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "CatFolders \u2013 Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Models/FolderModel.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Rest/Controllers/ImportController.php#L433"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2025-08-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-09-07T02:25:10.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-10T16:23:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T13:11:51.553884Z", "id": "CVE-2025-9776", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T13:12:34.153Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9776", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T13:11:51.553884Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T13:12:16.396Z"}}], "cna": {"title": "CatFolders \u2013 Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "catfolders", "product": "CatFolders \u2013 WordPress Media Library Folders & Categories", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-09-07T02:25:10.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-10T16:23:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Models/FolderModel.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Rest/Controllers/ImportController.php#L433"}], "descriptions": [{"lang": "en", "value": "The CatFolders \u2013 Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:53.204Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9776", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:53.204Z", "dateReserved": "2025-08-31T22:14:46.514Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T04:26:21.016Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CatFolders \u2013 WordPress Media Library Folders & Categories", "vendor": "catfolders", "versions": [{"lessThanOrEqual": "2.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CatFolders \u2013 Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin CatFolders - Tame Your WordPress Media Library by Category para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s de los contenidos de importaci\u00f3n CSV en todas las versiones hasta la 2.5.2, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-9776", "lastModified": "2026-09-30T23:10:00.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9776", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T13:11:51.553884Z", "version": "2.0.3"}}]}, "published": "2025-09-11T05:15:33.943", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Models/FolderModel.php#L376"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Rest/Controllers/ImportController.php#L433"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:39:41.172857+00:00", "value": {"mitigation_remediation": ["Upgrade the CatFolders plugin to the latest available release that removes the CSV Import vulnerability", "If upgrading is not immediately possible, disable the CSV Import feature or restrict its use to trusted administrators only", "Enforce stricter role management so that only trusted users possess author-level or higher privileges, reducing the number of potential attackers"], "summary": {"action": "Patch", "impact": "SQL Injection that allows an authenticated author or higher to extract sensitive database information"}, "threat_synthesis": {"affected_systems": "This issue affects the CatFolders \u2013 WordPress Media Library Folders & Categories plugin version 2.5.2 and earlier. All installations that have not applied an update beyond 2.5.2 are susceptible, while newer or patched versions are not impacted.", "description_and_impact": "The CatFolders plugin for WordPress is vulnerable to a time\u2011based SQL injection through the CSV Import feature in all releases up to and including 2.5.2. The vulnerability arises from insufficient escaping of user-supplied data and the absence of proper query preparation, enabling the attacker to inject additional SQL statements. This flaw is classified as CWE\u201189 and permits the extraction of confidential information from the site database.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1\u202f%, reflecting a low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers must have authenticated access at the author level or higher and must leverage the plugin\u2019s CSV Import endpoint to supply a crafted CSV payload that exploits the injection flaw. Successful exploitation would allow data exfiltration from the WordPress database."}}}}, "created": "2025-09-12T09:11:25.550196+00:00", "updated": "2026-04-20T19:45:15.509623+00:00", "vendors": ["catfolders", "catfolders$PRODUCT$tame_your_wordpress_media_library_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}