CVE-2026-13262

Name of the Vulnerable Software and Affected Versions Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin versions prior to 1.2.0

Description The plugin is subject to a generic SQL Injection, a flaw where an attacker can interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. An attacker can append additional SQL queries to extract sensitive information from the database. While the flaw is technically accessible to unauthenticated users, exploitation requires a valid get-smart-reply nonce. Since any user with Subscriber-level privileges can obtain this nonce by creating a ticket and visiting the ticket detail page, the issue is effectively exploitable by any authenticated user via the val parameter.

Recommendations Update the plugin to a version newer than 1.1.9. As a temporary mitigation, restrict access to the functionality utilizing the val parameter until the update is applied.