CVE-2026-32365: Collapsing Archives SQL Injection Flaw

CVE-2026-32365 Overview

CVE-2026-32365 is a Blind SQL Injection vulnerability discovered in the Collapsing Archives WordPress plugin developed by robfelty. This vulnerability allows authenticated attackers with low-level privileges to execute arbitrary SQL commands against the WordPress database through improper neutralization of special elements in SQL queries.

The Collapsing Archives plugin is a popular WordPress widget that displays archives in a collapsible format, making it easier for visitors to navigate through blog posts by date. The plugin's failure to properly sanitize user input before incorporating it into database queries creates a significant security risk for WordPress installations using this component.

Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database including user credentials, personal information, and site configuration through Blind SQL Injection techniques. The vulnerability also has potential to cause limited service disruption.

Affected Products

WordPress Collapsing Archives plugin version 3.0.7 and earlier
All WordPress installations using vulnerable versions of the collapsing-archives plugin

Discovery Timeline

2026-03-13 - CVE-2026-32365 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32365

Vulnerability Analysis

This SQL Injection vulnerability stems from inadequate input validation and sanitization within the Collapsing Archives plugin. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which describes flaws where user-controllable input is incorporated into SQL queries without proper escaping or parameterization.

The Blind SQL Injection nature of this vulnerability means that attackers cannot directly see the output of their injected queries in the application's response. Instead, they must infer information about the database structure and contents through timing-based or boolean-based techniques, observing how the application responds to true versus false conditions or measuring response delays.

The attack can be executed over the network and requires only low-level authentication (such as a subscriber account on WordPress), making it accessible to a wide range of potential attackers. The vulnerability has a scope change characteristic, meaning successful exploitation can impact resources beyond the vulnerable component itself, potentially affecting the entire WordPress installation and its underlying database.

Root Cause

The root cause of CVE-2026-32365 lies in the plugin's failure to implement proper prepared statements or parameterized queries when handling user-supplied input. Instead of treating user input as data, the vulnerable code concatenates input directly into SQL query strings, allowing attackers to inject malicious SQL syntax that modifies the intended query logic.

WordPress provides built-in functions such as $wpdb->prepare() for creating secure parameterized queries, but the Collapsing Archives plugin does not properly utilize these security mechanisms in the affected code paths. This oversight allows special SQL characters and keywords to be interpreted as part of the query structure rather than as literal data values.

Attack Vector

The attack vector is network-based, requiring an authenticated user with at least subscriber-level privileges on the target WordPress site. The attacker crafts malicious input containing SQL injection payloads and submits them through the plugin's vulnerable endpoints.

Since this is a Blind SQL Injection vulnerability, the attacker uses inference techniques to extract data:

Boolean-based blind injection: The attacker sends payloads that cause the application to return different responses based on whether injected conditions evaluate to true or false
Time-based blind injection: The attacker injects SQL commands that cause deliberate delays (using functions like SLEEP() or BENCHMARK()), allowing them to infer information based on response timing

The vulnerability mechanism involves crafted SQL injection payloads being passed to the plugin's database query functions. Due to improper input sanitization, these malicious payloads are executed as part of the SQL query, allowing attackers to extract database contents character by character through inference techniques. For detailed technical information, refer to the Patchstack security advisory.

Detection Methods for CVE-2026-32365

Indicators of Compromise

Unusual database query patterns or errors in WordPress debug logs indicating malformed SQL syntax
Abnormally slow page load times that could indicate time-based SQL injection probing
Authentication logs showing repeated requests from authenticated users with suspicious timing patterns
Database logs containing SQL injection fingerprints such as SLEEP(), BENCHMARK(), UNION SELECT, or boolean logic operators

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in HTTP requests
Enable WordPress database query logging and monitor for anomalous query structures
Implement rate limiting on plugin endpoints to slow down automated injection attacks
Use security plugins that provide real-time SQL injection detection capabilities

Monitoring Recommendations

Configure alerts for database queries containing suspicious SQL keywords and injection patterns
Monitor server response times for abnormal delays that may indicate time-based injection attempts
Review user activity logs for low-privilege accounts making unusual requests to archive functionality
Establish baseline metrics for normal plugin behavior to identify deviations

How to Mitigate CVE-2026-32365

Immediate Actions Required

Update the Collapsing Archives plugin to a patched version when available from the developer
If no patch is available, consider temporarily disabling or removing the plugin until a fix is released
Audit user accounts and remove unnecessary subscriber or contributor-level accounts that could be used to exploit this vulnerability
Implement additional WAF rules specifically targeting SQL injection attempts against WordPress plugins

Patch Information

Site administrators should monitor the official WordPress plugin repository and the Patchstack vulnerability database for security updates addressing this vulnerability. The affected versions include Collapsing Archives 3.0.7 and all prior versions.

When a patch becomes available, thoroughly test the updated plugin in a staging environment before deploying to production. Ensure backups are in place before applying any updates.

Workarounds

Temporarily deactivate the Collapsing Archives plugin if archive collapsing functionality is not critical to site operations
Restrict access to the WordPress admin area and authenticated areas by IP address where possible
Implement a Web Application Firewall with SQL injection protection rules enabled
Consider using alternative archive plugins that have been recently audited for security vulnerabilities

bash

# Configuration example - Disable the plugin via WP-CLI
wp plugin deactivate collapsing-archives

# Verify the plugin is deactivated
wp plugin list --status=inactive | grep collapsing-archives

# When patch is available, update the plugin
wp plugin update collapsing-archives

# Alternative: Remove the plugin entirely if not needed
wp plugin delete collapsing-archives