The Majestic Support plugin for WordPress contains a generic SQL injection flaw in the handling of the 'columns' parameter used with the 'saveusereraserequest' task. The plugin concatenates user‑supplied array keys directly into an SQL query without proper escaping or prepared statements, allowing an authenticated user with Subscriber privileges or higher to append arbitrary SQL code. This can be used to read sensitive database content or otherwise compromise data integrity. The weakness is classified as CWE‑89.

The flaw exists in all releases of Majestic Support up to and including version 1.2.2. The affected product is the "Majestic Support – The Leading‑Edge Help Desk & Customer Support Plugin" provided by ahmadmj for WordPress sites. Sites that have installed any of these versions and have users with Subscriber or higher roles are within scope.

The general CVSS score of 6.5 indicates a moderate severity vulnerability, and the lack of an EPSS score means the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker must be logged in as a user with permission to trigger the 'Add erase request' action, which is whitelisted for front‑end use and protected only by a nonce that the user can obtain from their own request page. The attack requires no advanced skills beyond crafting a malicious request, and it allows direct read‑only access to the database, posing a significant risk to confidentiality if exploitation succeeds.