The plugin vulnerable to generic SQL Injection via the 'val' parameter caused by insufficient escaping and lack of prepared statements. An attacker can append arbitrary SQL to the existing query and extract sensitive database information. The flaw is triggered when the attacker supplies the 'val' parameter within the context of a request that contains a valid 'get-smart-reply' nonce, which any authenticated Subscriber-level user can obtain. This allows authenticated users to exploit the injection, potentially exposing user data, login credentials, or other confidential information.

The affected product is Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. Versions up to and including 1.1.9 are impacted. The plugin can be found in WordPress installations where the plugin directory corresponds to "majestic-support" and the installed version is 1.1.9 or older.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers need to be authenticated as a Subscriber-level user and obtain the 'get-smart-reply' nonce, which can be acquired by creating a ticket via the public interface and viewing the ticket details. Once the nonce is in hand, the injection can be performed, giving the attacker the same privileges as the authenticated user for database queries. Because the attack requires an authenticated session, it may be easier for an attacker with compromised credentials rather than a fully unauthenticated attacker.