The vulnerability identified as CVE-2026-32366 involves improper neutralization of special elements in SQL commands within the robfelty Collapsing Categories plugin. This results in a Blind SQL Injection vulnerability that affects versions up to and including 3.0.9. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing the vulnerable component to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.