CVE-2026-13262 Overview
CVE-2026-13262 is a SQL Injection vulnerability [CWE-89] in the Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.9. It stems from insufficient escaping of the user-supplied val parameter and lack of prepared statements in the underlying SQL query. Authenticated attackers with Subscriber-level access can inject additional SQL statements to extract sensitive database contents. While exploitation requires a valid get-smart-reply nonce, any Subscriber can obtain one by creating a ticket through the public frontend and viewing the ticket detail page.
Critical Impact
Low-privileged users can extract sensitive data, including user credentials and personal information, from the WordPress database.
Affected Products
- Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress (versions ≤ 1.1.9)
- Vulnerable files: includes/ajax.php and modules/smartreply/model.php
- Fixed in version 1.2.0
Discovery Timeline
- 2026-07-11 - CVE-2026-13262 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-13262
Vulnerability Analysis
The vulnerability resides in the Smart Reply module of the Majestic Support plugin. The AJAX handler defined in includes/ajax.php accepts a user-supplied val parameter and passes it into a SQL query constructed in modules/smartreply/model.php at lines 183–184. The query does not use $wpdb->prepare() or apply sufficient escaping, which allows attackers to append arbitrary SQL clauses.
Exploitation is gated by the get-smart-reply nonce, which is exposed to any authenticated Subscriber. A Subscriber creates a support ticket through the public frontend and navigates to the ticket detail page rendered by modules/ticket/tpls/ticketdetail.php. That page emits the nonce required to invoke the vulnerable AJAX endpoint. As a result, the practical exploitation barrier is any low-privileged authenticated account.
Successful exploitation permits data extraction from the WordPress database, including user records, session information, and any custom tables written by the plugin. The vulnerability does not directly enable data modification or denial of service.
Root Cause
The root cause is a classic SQL Injection [CWE-89] pattern: user-controlled input is concatenated into a SQL query string without parameter binding. The developer relied on trust in the nonce-protected endpoint rather than proper query preparation. Since the nonce is trivially obtainable, the authorization boundary provides no meaningful defense.
Attack Vector
The attack is executed over the network against the WordPress AJAX endpoint. An attacker with any Subscriber account performs the following steps: obtain the get-smart-reply nonce from a ticket detail page, craft an HTTP POST request to the AJAX handler with a malicious val parameter containing appended SQL syntax, and receive the injected query result. See the Wordfence Vulnerability Report and the vulnerable code in model.php for technical details.
// No verified proof-of-concept code is publicly available.
// See the referenced WordPress plugin source lines and the Wordfence advisory
// for the exact vulnerable query construction pattern.
Detection Methods for CVE-2026-13262
Indicators of Compromise
- HTTP POST requests to /wp-admin/admin-ajax.php with action=get-smart-reply containing SQL keywords (UNION, SELECT, SLEEP, --) in the val parameter
- Unusual query patterns or errors in the WordPress database error log referencing the smartreply module
- Newly registered Subscriber accounts followed shortly by ticket creation and AJAX activity against the Smart Reply endpoint
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the val parameter on get-smart-reply AJAX calls for SQL metacharacters and common injection payloads
- Enable MySQL general query logging temporarily to identify queries originating from the smartreply model that include appended clauses
- Correlate WordPress authentication logs with AJAX request volume from Subscriber accounts to surface anomalous ticket-and-query sequences
Monitoring Recommendations
- Alert on any Subscriber-role account making high volumes of admin-ajax.php calls with the get-smart-reply action
- Monitor for outbound data patterns consistent with database exfiltration, such as long response bodies from AJAX endpoints
- Track plugin version inventory across WordPress sites to identify hosts still running Majestic Support ≤ 1.1.9
How to Mitigate CVE-2026-13262
Immediate Actions Required
- Upgrade the Majestic Support plugin to version 1.2.0 or later on all WordPress installations
- Audit existing Subscriber accounts and remove any that are unrecognized or inactive
- Review WordPress and database logs for evidence of prior exploitation attempts against the get-smart-reply endpoint
Patch Information
The vendor addressed the issue in version 1.2.0. The fix is visible in the updated smartreply/model.php at revision 3599140, which introduces proper query preparation for the val parameter. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- If patching is not immediately possible, deactivate the Majestic Support plugin until the upgrade can be applied
- Restrict user registration on the WordPress site to prevent unauthenticated attackers from obtaining Subscriber accounts
- Deploy a WAF rule that blocks SQL metacharacters in the val POST parameter for the get-smart-reply action
# Upgrade the Majestic Support plugin using WP-CLI
wp plugin update majestic-support --version=1.2.0
# Verify the installed version
wp plugin get majestic-support --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
