The CatFolders plugin for WordPress is vulnerable to a time‑based SQL injection through the CSV Import feature in all releases up to and including 2.5.2. The vulnerability arises from insufficient escaping of user-supplied data and the absence of proper query preparation, enabling the attacker to inject additional SQL statements. This flaw is classified as CWE‑89 and permits the extraction of confidential information from the site database.

This issue affects the CatFolders – WordPress Media Library Folders & Categories plugin version 2.5.2 and earlier. All installations that have not applied an update beyond 2.5.2 are susceptible, while newer or patched versions are not impacted.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, reflecting a low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers must have authenticated access at the author level or higher and must leverage the plugin’s CSV Import endpoint to supply a crafted CSV payload that exploits the injection flaw. Successful exploitation would allow data exfiltration from the WordPress database.