Majestic Support CVE-2026-115820

Requires an authenticated WordPress account at Subscriber level or above (PR:L); however this barrier is weak because the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately retrieves from their own 'Add erase request' page. The injection is delivered through the 'columns (array keys)' parameter against Majestic Support ≤1.2.2 in its default configuration - no special plugin setting or non-default mode is needed. The practical limiting factor is solely that the attacker must hold a valid low-privilege login, which is trivial on sites that allow open user registration and harder on sites that disable self-registration; no user interaction by a victim is required (UI:N).

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection that requires authentication at only Subscriber level - the lowest-privilege authenticated role and one that is open for self-registration on many WordPress sites, which makes the PR:L barrier very weak in practice. The description reinforces that the authentication gate is nearly meaningless: the 'saveusereraserequest' task is whitelisted for front-end customer use, a help-desk record is auto-provisioned for every account, and the only control is a nonce the attacker legitimately obtains from their own page. Impact is confidentiality-only (C:H, I:N, A:N), consistent with a data-extraction SQLi that can read the WordPress database (users, password hashes, secrets). No EPSS score, KEV listing, or confirmed working exploit is present in the supplied data, and the vuln.today decision label is 'this_month' rather than act_now/emergency - so there is no evidence of active exploitation or mass automation at this time. Signals are internally consistent (network vector matches a WordPress AJAX endpoint; low privilege matches a self-registerable role), so the main residual risk driver is the near-trivial authentication requirement combined with confirmed high confidentiality impact.

An attacker self-registers (or uses any existing Subscriber account) on a WordPress site running Majestic Support ≤1.2.2, opens their own 'Add erase request' page to obtain a valid nonce, and submits a crafted 'saveusereraserequest' request with malicious SQL injected through the 'columns' array keys. Because the parameter is insufficiently escaped and the query is not properly prepared, the injected SQL executes and returns sensitive database contents such as user records and password hashes. No public working exploit is identified in the supplied data, though the vendor (Wordfence) advisory and the vulnerable source lines are publicly referenced.