The CatFolders WordPress plugin suffers from a time-based SQL Injection vulnerability (CWE-89) in its CSV Import functionality. The issue arises from insufficient escaping of user-supplied parameters and lack of proper SQL query preparation, enabling authenticated users with Author-level privileges or above to append malicious SQL commands. This can lead to unauthorized disclosure of sensitive database information. The vulnerability affects all versions up to and including 2.5.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with Author-level access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The impact is limited to confidentiality as integrity and availability are not affected. Since the attacker must be authenticated with specific privileges, the risk is moderate but significant in environments where such user roles are assigned.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling the CSV Import feature if not needed. Monitor for updates from the CatFolders plugin vendor and apply patches promptly once available.