Majestic Support <= 1.1.9 SQL Injection (CVE-2026-13262) Advisory

Vulnerability Overview Vulnerability Name: Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter CVE ID: CVE-2026-13262 CVSS Score: 6.5 (Medium) Publish Date: July 10, 2026 Last Updated: July 11, 2026 Researcher: CHOIYEONGMIN Scope of Impact Software Type: Plugin Software Name: Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin Affected Versions: <= 1.1.9 Fixed Version: 1.2.0 Remediation Recommendation: Update to version 1.2.0 or later patched versions Vulnerability Description The Majestic Support plugin for WordPress contains a SQL injection vulnerability via the 'val' parameter. This vulnerability allows an attacker to extract sensitive information from the database by appending additional SQL queries to existing ones. Exploiting this vulnerability requires the 'get-smart-reply' capability, which can be achieved by any user at the Subscriber level by creating a ticket and accessing the generated ticket details page. Reference Links plugins.trac.wordpress.org Additional Information Vulnerability Database: Wordfence Intelligence Vulnerability Database API API Usage: Free for personal and commercial use, containing all vulnerability data present in the user interface. Recent Related Vulnerabilities Majestic Support <= 1.1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference - CVE ID: CVE-2026-57646 - CVSS Score: 4.3 - Researcher: William Matos - Publish Date: June 26, 2026 Majestic Support <= 1.1.2 - Missing Authorization - CVE ID: CVE-2025-40778 - CVSS Score: 6.3 - Researcher: Jakub Herman - Publish Date: April 9, 2026 Majestic Support <= 1.1.0 - Missing Authorization - CVE ID: CVE-2025-49860 - CVSS Score: 5.3 - Researcher: Fariq Fadillah Gusti Insani (faridgi) - Publish Date: June 12, 2025 Majestic Support <= 1.1.0 - Unauthenticated SQL Injection - CVE ID: CVE-2025-48283 - CVSS Score: 7.5 - Researcher: LVFtholv2k - Publish Date: May 22, 2025 Majestic Support <= 1.1.0 - Missing Authorization - CVE ID: CVE-2025-48282 - CVSS Score: 5.3 - Researcher: LVFtholv2k - Publish Date: May 19, 2025 Majestic Support <= 1.0.7 - Authenticated (Contributor+) Local File Inclusion - CVE ID: CVE-2025-64284 - CVSS Score: 7.5 - Researcher: Trương Hữu Phúc (truonghuphuc) - Publish Date: April 22, 2025 Majestic Support <= 1.0.6 - Unauthenticated Local File Inclusion - CVE ID: CVE-2025-26965 - CVSS Score: 9.8 - Researcher: Trương Hữu Phúc (truonghuphuc) - Publish Date: February 23, 2025 Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory - CVE ID: CVE-2024-13600 - CVSS Score: 7.5 - Researcher: Tim Coen - Publish Date: February 11, 2025 Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference - CVE ID: CVE-2024-13601 - CVSS Score: 4.3 - Researcher: Tim Coen - Publish Date: February 11, 2025 Additional Resources Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Installs to immediately notify you if your site is affected by new vulnerabilities. Wordfence Intelligence WordPress Vulnerability Database: Completely free for access and querying, providing data via API. Contact Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, 365 days a year, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: MITRE License, allowing copying, preparing derivative works, public display, public performance, distribution, etc. Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Facebook: Link Twitter: Link LinkedIn: Link Email: Link Footer Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Stay Updated: Register to receive news and updates (Note: The remaining sections in the source text are duplicates of the above and have been translated once.)

Goal Reached Thanks to every supporter — we hit 100%!

Majestic Support <= 1.1.9 SQL Injection (CVE-2026-13262) Advisory

More from this source