[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-Tns4kqMgj-sbCHwknIUC-t1qW97hoV3an8xnJ5BnpU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13262","majestic-support-authenticated-subscriber-sql-injection-via-val-parameter","Majestic Support \u003C= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter","The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.","majestic-support",null,"\u003C=1.1.9","1.2.0","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-10 14:20:24","2026-07-11 02:31:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F502577dd-49e3-419d-8b37-591be69ad131?source=api-prod",1,[22,23,24,25,26,27,28,29],"includes\u002Factivation.php","includes\u002Faddon-updater\u002Fmsupdater.php","includes\u002Fajax.php","includes\u002Fcss\u002Fadmincss.css","includes\u002Fcss\u002Fstyle.css","includes\u002Fdeactivation.php","includes\u002Fmajesticsupportphplib.php","includes\u002Fms-hooks.php","researched",false,3,"Sorry, I cannot fulfill your request. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating functional exploit plans or actionable payloads for specific software vulnerabilities. For information on securing WordPress installations and defending against SQL injection, I recommend consulting resources from OWASP or the WordPress Security Team.","The Majestic Support plugin for WordPress (\u003C= 1.1.9) is vulnerable to SQL Injection via the 'val' parameter in the 'getSmartReply' function. Authenticated users with Subscriber-level access can capture a specific nonce from a ticket detail page and execute arbitrary SQL commands to extract sensitive data from the database.","\u002F\u002F includes\u002Fajax.php:14\n$MJTC_functions_allowed = array('DataForDepandantField','subscribeForNotifications','unsubscribeFromNotifications','getDownloadById','getAllDownloads','sendTestEmail','getuserlistajax','getmultiformlistajax','getFieldsForComboByFieldFor','getSectionToFillValues','getListTranslations','validateandshowdownloadfilename','getlanguagetranslation','updateUserDevice','checkParentType','checkChildType','makeParentOfType','getTypeForByParentId','getusersearchstaffreportajax','getusersearchuserreportajax','getusersearchajax','saveuserprofileajax','getHelpTopicByDepartment','getpremadeajax','getPremadeByDepartment','getTicketsForMerging','getLatestReplyForMerging','getReplyDataByID','getTimeByReplyID','getTimeByNoteID','readEmailsAjax','getOptionsForFieldEdit','storePrivateCredentials','getFormForPrivteCredentials', 'getPrivateCredentials', 'removePrivateCredential','getWcOrderProductsAjax','markUnmarkTicketNonPremiumAjax','linkTicketPaidSupportAjax','getEDDOrderProductsAjax','getEDDProductlicensesAjax','uploadStaffImage','installPluginFromAjax','activatePluginFromAjax','listEmailTemplate','deleteEmailTemplate','getDefaultEmailTemplate','getHtmlForMoreEmail','getHtmlForMoreConditions','getOperatorsByTitleForCombobox','getValuesByTitleForCombobox','getChildForVisibleCombobox','getConditionsForVisibleCombobox','deleteSupportCustomImage','reviewBoxAction','MJTC_isFieldRequired','getOptionsForEditSlug','checkSmartReply','getSmartReply','getTicketCloseReasonsForPopup','downloadandinstalladdonfromAjax','deleteCategoryLogo','deleteAgentLogo','getHtmlForORRow','getHtmlForANDRow','checkAIReplyTicketsBySubject','markedAsAiPoweredReply','getFilteredReplies','getSmartReplyResponse','mjtc_save_dashboard_layout','getHtmlForAssignPopup','getInternalNoteForEdit','getInstantFixes','scrapeUrlData','instantFixGetFragments','instantFixSync','instantFixDeleteFragment','instantFixUpdateInterval','instantFixToggleStatus','recordInstantFixDeflection','recordInstantFixClick','saveApiKey','savePreferences','syncDataBundle','ajaxGetWrappers','generateReply','delete_log','pgGetCategories','pgGetUseCases','pgGetWrappers','pgGetSchema','pgGetBlockTemplates','pgGetLanguages','pgGetModels','pgExecute','checkPolicyTask','discardDraftTask');\n$MJTC_task = MJTC_request::MJTC_getVar('task');\nif($MJTC_task != '' && in_array($MJTC_task, $MJTC_functions_allowed)){\n    $MJTC_module = MJTC_request::MJTC_getVar('mjsmod');\n    $MJTC_module = MJTC_majesticsupportphplib::MJTC_clean_file_path($MJTC_module);\n    $MJTC_result = MJTC_includer::MJTC_getModel($MJTC_module)->$MJTC_task();\n    echo wp_kses($MJTC_result, MJTC_ALLOWED_TAGS);\n    die();\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmajestic-support\u002F1.1.9\u002Fincludes\u002Factivation.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmajestic-support\u002F1.2.0\u002Fincludes\u002Factivation.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmajestic-support\u002F1.1.9\u002Fincludes\u002Factivation.php\t2026-06-24 05:29:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmajestic-support\u002F1.2.0\u002Fincludes\u002Factivation.php\t2026-07-07 13:48:26.000000000 +0000\n@@ -183,8 +183,8 @@\n                     ('tplink_tickets_user', '1', 'tplink', NULL),\n                     ('show_breadcrumbs', '1', 'default', NULL),\n                     ('productcode', 'mjsupport', 'default', NULL),\n-                    ('versioncode', '1.1.9', 'default', NULL),\n-                    ('productversion', '119', 'default', NULL),\n+                    ('versioncode', '1.2.0', 'default', NULL),\n+                    ('productversion', '120', 'default', NULL),\n                     ('producttype', 'free', 'default', NULL),\n                     ('tve_enabled', '2', 'default', NULL),\n                     ('tve_mailreadtype', '3', 'default', NULL),\n@@ -319,11 +319,11 @@\n                     ('enable_instant_fixes', '1', 'instantfix', 'instantfix'),\n                     ('instant_fixes_min_score', '0.5', 'instantfix', 'instantfix'),\n                     ('instant_fixes_limit', '2', 'instantfix', 'instantfix'),\n-                    ('zywrap_enable_sentiment', '1', 'default', NULL),\n-                    ('zywrap_auto_route', '1', 'default', NULL),\n-                    ('zywrap_auto_priority', '1', 'default', NULL),\n-                    ('zywrap_detect_sales', '1', 'default', NULL),\n-                    ('zywrap_enable_policy', '1', 'default', NULL),\n+                    ('zywrap_enable_sentiment', '0', 'default', NULL),\n+                    ('zywrap_auto_route', '0', 'default', NULL),\n+                    ('zywrap_auto_priority', '0', 'default', NULL),\n+                    ('zywrap_detect_sales', '0', 'default', NULL),\n+                    ('zywrap_enable_policy', '0', 'default', NULL),\n                     ('zywrap_policy_url', '', 'default', NULL),\n                     ('zywrap_enable_followup', '1', 'default', NULL),\n                     ('zywrap_enable_deflection', '1', 'default', NULL),","1. Log in to the WordPress site with at least Subscriber-level privileges.\n2. Create a new support ticket via the public-facing 'Majestic Support' interface.\n3. Navigate to the detail page of the newly created ticket and inspect the page source or JavaScript variables to locate the 'get-smart-reply' nonce.\n4. Send a POST request to the WordPress AJAX endpoint (\u002Fwp-admin\u002Fadmin-ajax.php) with the following parameters:\n   - action: 'mjsupport_ajax'\n   - task: 'getSmartReply'\n   - mjsmod: 'majesticsupport' (or the relevant model module)\n   - val: A malicious SQL payload (e.g., '1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)') appended to the expected value.\n   - _wpnonce: The captured 'get-smart-reply' nonce.\n5. Observe the server response (e.g., time delay) to confirm successful SQL injection.","gemini-3-flash-preview","2026-07-15 09:13:48","2026-07-15 09:14:25",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.1.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmajestic-support\u002Ftags\u002F1.1.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmajestic-support.1.1.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmajestic-support\u002Ftags\u002F1.2.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmajestic-support.1.2.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmajestic-support\u002Ftags"]