SQL Injection Vulnerability in Majestic Support Help Desk Plugin for WordPress

CVE-2026-115820

What is CVE-2026-115820?

The Majestic Support plugin for WordPress is susceptible to an SQL Injection vulnerability through the 'columns (array keys)' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. Authenticated users, specifically those with subscriber-level access or higher, can exploit this flaw to inject additional SQL queries into existing ones. As a result, sensitive information can be retrieved from the database. The exploitation potential is enhanced because the plugin automatically provision new help-desk records for every WordPress account and allows the submission of 'erase requests' without stringent validation other than a nonce token achievable by legitimate users.

References