CVE-2025-9776: CatFolders WordPress Plugin SQL Injection

CVE-2025-9776 Overview

CVE-2025-9776 is a time-based SQL injection vulnerability in the CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress. The flaw affects all plugin versions up to and including 2.5.2. It stems from insufficient escaping of user-supplied CSV import content and insufficient preparation of the underlying SQL query. Authenticated attackers with Author-level access or above can append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database. The weakness is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated Author-level users can perform time-based SQL injection via CSV import to exfiltrate database contents, including user credentials and site secrets.

Affected Products

CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress
All versions up to and including 2.5.2
WordPress installations with Author-level or higher user accounts enabled

Discovery Timeline

2025-09-11 - CVE-2025-9776 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-9776

Vulnerability Analysis

The vulnerability resides in the CatFolders plugin's CSV import handler. The import routine passes user-controlled CSV contents into an SQL query without proper escaping or parameterization. An authenticated attacker uploads a crafted CSV file through the plugin's REST import endpoint. The injected payload is concatenated into a database query processed by the plugin's folder model logic.

Because the injection point is time-based, attackers use conditional SLEEP() or BENCHMARK() constructs to infer data one bit at a time by measuring server response delays. This technique allows extraction of arbitrary table contents, including the wp_users table where password hashes and email addresses are stored. Exploitation requires an authenticated session with Author-level privileges or higher, which limits exposure to sites where untrusted contributors have content-publishing rights.

Root Cause

The root cause is the absence of prepared statements and inadequate sanitization of CSV input before SQL concatenation. Relevant code paths include the plugin's ImportController.php CSV handler and the FolderModel.php query construction logic. See the WordPress CatFolders ImportController Code and WordPress CatFolders FolderModel Code for the vulnerable code paths.

Attack Vector

The attack is executed over the network through the plugin's authenticated REST API import endpoint. The attacker crafts a CSV file containing SQL payloads in fields that the import controller inserts into database queries. Submitting the file triggers execution of the attacker's injected SQL within the WordPress database context. No user interaction is required beyond the attacker's own authenticated session. For additional analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-9776

Indicators of Compromise

Unexpected CSV import requests to the CatFolders REST API endpoints originating from Author-level or higher accounts
WordPress database query logs containing SLEEP(, BENCHMARK(, UNION SELECT, or INFORMATION_SCHEMA references near plugin SQL
Abnormally long request durations on /wp-json/catfolders/ import routes
CSV upload artifacts in the WordPress uploads directory containing SQL metacharacters

Detection Strategies

Enable WordPress query logging or MySQL general query logging and alert on queries combining plugin table prefixes with time-delay functions
Deploy a web application firewall rule to inspect multipart CSV uploads targeting CatFolders endpoints for SQL syntax patterns
Monitor for Author or Editor account activity that includes repeated or scripted CSV import attempts

Monitoring Recommendations

Review authentication logs for Author-level accounts performing administrative plugin actions outside expected patterns
Correlate HTTP response time anomalies on plugin REST endpoints with user session identifiers
Audit WordPress user roles and remove unused Author-or-higher accounts to shrink the exploitable population

How to Mitigate CVE-2025-9776

Immediate Actions Required

Update the CatFolders plugin to a version later than 2.5.2 as soon as a patched release is available from the vendor
Audit all WordPress accounts with Author, Editor, or Administrator roles and remove or demote any unneeded accounts
Rotate WordPress user passwords and any database or API secrets that could have been exposed if exploitation is suspected
Review web server and database logs for prior CSV import activity against CatFolders endpoints

Patch Information

At the time of publication, the vulnerability is confirmed in all versions up to and including 2.5.2. Site operators should monitor the plugin's WordPress.org page and the Wordfence Vulnerability Analysis advisory for the fixed version and apply it across all WordPress instances using the plugin.

Workarounds

Deactivate and remove the CatFolders plugin until a patched version is installed
Restrict access to the CatFolders REST import endpoints at the web server or WAF layer to trusted administrator IP addresses
Temporarily revoke Author-level and above access from untrusted contributors to prevent exploitation
Apply a WAF signature that blocks SQL metacharacters and time-delay functions in CSV upload payloads

bash

# Example WAF rule concept (ModSecurity) to block SQL keywords in CatFolders CSV uploads
SecRule REQUEST_URI "@contains /wp-json/catfolders" \
  "id:1009776,phase:2,deny,status:403,log,\
  msg:'Potential CVE-2025-9776 SQLi in CatFolders CSV import',\
  chain"
  SecRule REQUEST_BODY "@rx (?i)(sleep\(|benchmark\(|union\s+select|information_schema)" "t:none"