CVE-2026-32366: Collapsing Categories SQLi Vulnerability

CVE-2026-32366 Overview

CVE-2026-32366 is a Blind SQL Injection vulnerability affecting the Collapsing Categories WordPress plugin (collapsing-categories) developed by robfelty. This vulnerability allows attackers to execute malicious SQL queries against the underlying database by exploiting improper neutralization of special elements in SQL commands. Due to the blind nature of this injection, attackers can extract sensitive information from the database through time-based or boolean-based inference techniques without receiving direct error messages.

Critical Impact
Authenticated attackers with low privileges can exploit this blind SQL injection to extract sensitive database contents, potentially compromising user credentials, configuration data, and other confidential information stored in the WordPress database.

Affected Products

Collapsing Categories WordPress Plugin versions up to and including 3.0.9
WordPress installations using the collapsing-categories plugin
All configurations of the affected plugin versions

Discovery Timeline

2026-03-13 - CVE-2026-32366 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32366

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The Collapsing Categories plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries executed against the WordPress database.

As a blind SQL injection, the vulnerability does not return query results directly to the attacker. Instead, exploitation relies on observing differences in application behavior (boolean-based) or response timing (time-based) to infer database contents character by character. This makes exploitation slower but equally dangerous as traditional SQL injection.

The attack can be executed over the network by authenticated users with low privilege levels. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable component itself, potentially compromising the entire WordPress database.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize, validate, or parameterize user input before using it in SQL query construction. The Collapsing Categories plugin directly incorporates user-controlled data into database queries without using prepared statements or adequate input filtering, allowing attackers to manipulate query logic through specially crafted input containing SQL metacharacters.

Attack Vector

The attack vector is network-based, requiring the attacker to have low-level authentication to the WordPress installation. Once authenticated, the attacker can submit malicious input containing SQL injection payloads through the plugin's vulnerable parameters. The blind nature of the injection means the attacker must use inference techniques such as:

Time-based inference: Injecting conditional delays (e.g., SLEEP() functions) to determine if conditions are true based on response timing
Boolean-based inference: Observing differences in application responses to determine if injected conditions evaluate to true or false

Through iterative queries, attackers can systematically extract database schema information, user credentials, and other sensitive data stored in the WordPress database.

Detection Methods for CVE-2026-32366

Indicators of Compromise

Unusual SQL-related patterns in web server logs, particularly requests containing SQL keywords like SLEEP, BENCHMARK, UNION, SELECT, or comment sequences (--, /*)
Abnormally long response times for specific plugin-related requests indicating time-based SQL injection attempts
Multiple sequential requests to the same endpoint with incrementally varying parameters suggesting automated extraction attempts
Database query logs showing unexpected or malformed queries originating from the plugin's functionality

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in HTTP requests
Enable WordPress database query logging to identify suspicious query patterns or unexpected database access
Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns
Monitor application response times for anomalies that could indicate time-based injection exploitation

Monitoring Recommendations

Review web server access logs regularly for requests containing SQL injection signatures targeting the collapsing-categories plugin
Configure alerts for database queries with unusual execution times or suspicious syntax
Monitor user activity logs for authenticated users making abnormal numbers of requests to plugin endpoints
Implement real-time log analysis to detect automated SQL injection exploitation attempts

How to Mitigate CVE-2026-32366

Immediate Actions Required

Update the Collapsing Categories plugin to a patched version as soon as one becomes available from the developer
Consider temporarily disabling the Collapsing Categories plugin until a security patch is released
Review WordPress user accounts and remove unnecessary privileges to minimize the attack surface
Implement Web Application Firewall rules to block SQL injection attempts targeting the plugin

Patch Information

At the time of publication, organizations should monitor the Patchstack Vulnerability Report for updates regarding security patches. The affected versions include all releases from initial release through version 3.0.9. Users should upgrade to the first available patched version once released by the developer.

Workarounds

Disable the Collapsing Categories plugin entirely if it is not essential to site functionality
Implement strict Web Application Firewall rules to filter SQL injection patterns in all incoming requests
Restrict authenticated user access to only trusted individuals until a patch is available
Consider using alternative WordPress category display plugins that are actively maintained and security-audited

bash

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate collapsing-categories --path=/var/www/html/wordpress

# Verify the plugin is deactivated
wp plugin status collapsing-categories --path=/var/www/html/wordpress