CVE-2025-9776

🗓️ 11 Sep 2025 04:26:21Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

Authenticated WordPress users with author+ access can exploit time-based SQL injection via CSV import in CatFolders up to 2.5.2.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2025-9776	13 Sep 202506:24	–	githubexploit
Circl	CVE-2025-9776	11 Sep 202506:56	–	circl
CNNVD	WordPress plugin CatFolders SQL注入漏洞	11 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-9776 CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import	11 Sep 202504:26	–	cvelist
EUVD	EUVD-2025-28906	3 Oct 202520:07	–	euvd
NVD	CVE-2025-9776	11 Sep 202505:15	–	nvd
Packet Storm	📄 WordPress CatFolders 2.5.2 SQL Injection	8 May 202600:00	–	packetstorm
Patchstack	WordPress CatFolders plugin <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import vulnerability	11 Sep 202500:56	–	patchstack
Positive Technologies	PT-2025-37112	11 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9776	13 Sep 202505:19	–	redhatcve

Vulners

Node

catfolders catfolders_wordpress_media_library_folders_&_categoriesRange≤2.5.2wordpress

[
  {
    "vendor": "catfolders",
    "product": "CatFolders – WordPress Media Library Folders & Categories",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Rest/Controllers/ImportController.php
plugins	www.plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Models/FolderModel.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f

Parameter	Position	Path	Description	CWE
attachments	upload data	wp-json/catf/v1/import-csv	Authenticated SQL injection via CSV import in CatFolders plugin (attachments column is unsafely used to build IN (...) SQL clause).	CWE-89

17 Jun 2026 10:09Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.5

EPSS0.00347

SSVC

CWE-89