SQL Injection Vulnerability in AI Copilot – Content Generator Plugin for WordPress

CVE-2026-13009

What is CVE-2026-13009?

The AI Copilot – Content Generator plugin for WordPress is susceptible to SQL Injection through the 'order[0][dir]' parameter, affecting all versions up to and including 1.5.4. This vulnerability arises from inadequate escaping of user-supplied data and a lack of proper SQL query preparation. Authenticated attackers, possessing subscriber-level access or higher, can exploit this flaw to inject additional SQL queries into existing ones, facilitating the extraction of sensitive database information. Notably, the required waic-nonce is released on the front-end whenever specific shortcodes are rendered, allowing contributor-level users who can publish these shortcodes to acquire a valid nonce, thus accessing the vulnerable AJAX handler without sufficient capability checks beyond nonce validation.

References