Majestic Support The Leading Edge Help Desk Customer Support Plugin
Monthly
SQL injection in the Majestic Support help desk plugin for WordPress (all versions up to and including 1.2.2) lets any authenticated user at Subscriber level or above append additional SQL into existing help-desk queries and read sensitive data from the site database, with confidentiality fully impacted but no integrity or availability effect. The login requirement is a weak barrier: the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately retrieves from their own 'Add erase request' page, so any site with open registration is effectively exposed to any self-registered user. No public exploit code has been identified at time of analysis, the issue is rated moderate priority (CVSS 6.5, PR:L, UI:N) rather than an emergency, and the vendor has published a fixed release, 1.2.3.
SQL injection in the Majestic Support WordPress help desk plugin (versions up to and including 1.1.9) allows any authenticated WordPress user to extract sensitive data from the site's database by appending arbitrary SQL to queries via the unsanitized 'val' AJAX parameter. Although the description characterizes attackers as 'unauthenticated,' exploitation in practice requires a Subscriber-level account to obtain a 'get-smart-reply' nonce - a low but real barrier accurately reflected in the CVSS PR:L rating. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nonce-acquisition path (create a ticket, visit the result page) means any user permitted to submit support requests can exploit this on unpatched deployments. Version 1.2.0 appears to resolve the issue based on source code changes in the referenced repository tags.
SQL injection in the Majestic Support help desk plugin for WordPress (all versions up to and including 1.2.2) lets any authenticated user at Subscriber level or above append additional SQL into existing help-desk queries and read sensitive data from the site database, with confidentiality fully impacted but no integrity or availability effect. The login requirement is a weak barrier: the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately retrieves from their own 'Add erase request' page, so any site with open registration is effectively exposed to any self-registered user. No public exploit code has been identified at time of analysis, the issue is rated moderate priority (CVSS 6.5, PR:L, UI:N) rather than an emergency, and the vendor has published a fixed release, 1.2.3.
SQL injection in the Majestic Support WordPress help desk plugin (versions up to and including 1.1.9) allows any authenticated WordPress user to extract sensitive data from the site's database by appending arbitrary SQL to queries via the unsanitized 'val' AJAX parameter. Although the description characterizes attackers as 'unauthenticated,' exploitation in practice requires a Subscriber-level account to obtain a 'get-smart-reply' nonce - a low but real barrier accurately reflected in the CVSS PR:L rating. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nonce-acquisition path (create a ticket, visit the result page) means any user permitted to submit support requests can exploit this on unpatched deployments. Version 1.2.0 appears to resolve the issue based on source code changes in the referenced repository tags.