Threats tagged 'ghsa-x95v-7hp5-9vfq'

The Majestic Support WordPress plugin up to version 1.2.2 contains a SQL Injection vulnerability via the 'columns (array keys)' parameter. Authenticated users with subscriber-level access can exploit this flaw to append SQL queries and extract sensitive database information. The vulnerability arises from insufficient escaping and preparation of user input in SQL queries. Exploitation requires the attacker to obtain a nonce from their own 'Add erase request' page, which is legitimately accessible to subscribers.