Security Alert Summary
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress contains an SQL injection vulnerability that can be triggered by authenticated users with Subscriber-level access. The issue relates to a user-supplied parameter used in query construction without sufficient escaping or preparation, allowing an attacker to append additional SQL to existing queries and potentially extract sensitive data from the database.
CVE Details
- CVE ID: CVE-2026-115820
- Affected component: Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
- Affected versions: All versions up to and including 1.2.2
- Published: October 30, 2026 at 6:17:23 PM UTC
- Last modified: October 30, 2026 at 7:18:12 PM UTC
- CVSS v3.1 base score: 6.5 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: Requires authentication. Privileges required: Low (authenticated user with Subscriber-level access is sufficient). User interaction: None.
- Primary impact: Confidentiality: High. Integrity: None. Availability: None.
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
This vulnerability is a generic SQL injection caused by insufficient escaping and lack of proper preparation of a user-supplied parameter. The plugin accepts a columns (array keys) parameter which is incorporated into an existing SQL query without adequate sanitization or parameterization, allowing an authenticated attacker to append additional SQL statements to queries.
The issue can be reached from the plugin functionality that handles front-end requests: the saveusereraserequest task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker can legitimately obtain from their own “Add erase request” page. The JSON references include plugin files such as includes/formhandler.php, includes/tables/table.php, and modules/gdpr/controller.php and modules/gdpr/model.php, which are relevant to the affected code paths.
Impact: an authenticated user with Subscriber-level access can exploit the vulnerable parameter to extract sensitive information from the database. The vulnerability affects confidentiality (data disclosure) but, according to the provided data, does not directly impact integrity or availability.
How This Could Impact Your Website
Consider a small team using WordPress where site owners, internal staff, and external contributors all have accounts. If a subscriber-level account is present (for example, a customer, external contractor, or low-privilege contributor), an attacker using that account could leverage this vulnerability to query the database and extract sensitive records linked to the help-desk system. Practical consequences may include exposure of internal user email addresses and other sensitive fields stored in help-desk records, increasing the risk of targeted phishing or social engineering against staff and customers.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially subscriber-level accounts that are not required.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, especially database query anomalies and unexpected data exports.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://downloads.wordpress.org/plugin/majestic-support.1.2.3.zip
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.2.2/includes/formhandler.php#L68
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.2.2/includes/tables/table.php#L50
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.2.2/includes/tables/table.php#L72
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.2.2/modules/gdpr/controller.php#L80
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.2.2/modules/gdpr/model.php#L83
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ada488fa-26d3-405f-8f89-edd8d10e8cc8?source=cve
