The vulnerability CVE-2026-32366 involves improper neutralization of special elements in SQL commands within the robfelty Collapsing Categories plugin, allowing blind SQL injection. It affects all versions up to and including 3.0.9. The CVSS score of 8.5 indicates a high-severity issue with network attack vector, low attack complexity, requiring low privileges and no user interaction, with a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact. There is no vendor advisory or patch information currently available.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially exposing sensitive data (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (low availability impact). No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable plugin and monitor for suspicious activity. Avoid exposing the affected service to untrusted networks. Apply vendor updates promptly once released.