CVE-2026-13262 describes an SQL Injection vulnerability in the Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. Versions up to and including 1.1.9 are affected due to improper neutralization of special elements in SQL commands via the 'val' parameter. The vulnerability arises from insufficient escaping of user-supplied input and lack of prepared statements in the SQL query construction. An attacker with Subscriber-level privileges can obtain a required nonce by creating a ticket and accessing its detail page, enabling exploitation to append malicious SQL queries and extract sensitive data from the database. There is no vendor advisory or patch available at this time.

An authenticated user with Subscriber-level privileges can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not require higher privileges or user interaction beyond creating a ticket and accessing its details. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and monitor for suspicious activity related to ticket creation and smart reply functionality. Avoid exposing the vulnerable plugin on publicly accessible sites if feasible.