CVE-2023-32590

CRITICAL NUCLEI

Subscribe to Category < 2.7.4 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-32590. PoCs published by RandomRobbieBF. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2023-32590, an unauthenticated SQL injection vulnerability in the Subscribe to Category WordPress plugin (versions up to 2.7.4). The PoC includes a SQLMap scan demonstrating time-based blind SQL injection via the 'sender' parameter in a JSON payload.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.

Exploits (1)

nomisec WORKING POC
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2023-32590

This repository contains a proof-of-concept for CVE-2023-32590, an unauthenticated SQL injection vulnerability in the Subscribe to Category WordPress plugin (versions up to 2.7.4). The PoC includes a SQLMap scan demonstrating time-based blind SQL injection via the 'sender' parameter in a JSON payload.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Subscribe to Category WordPress plugin <= 2.7.4
No auth needed
Prerequisites: WordPress site with vulnerable plugin installed · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Subscribe to Category <= 2.7.4 - SQL Injection
CRITICALVERIFIEDby Shivam Kamboj

References (1)

Core 1

Scores

CVSS v3 9.3
EPSS 0.0165
EPSS Percentile 73.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Details

CWE
CWE-89
Status published
Products (2)
Daniel Söderström / Sidney van de Stouwe/Subscribe to Category < 2.7.4
subscribe_to_category_project/subscribe_to_category < 2.7.4
Published Dec 20, 2023
Tracked Since Feb 18, 2026