CVE-2026-13009 AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter

🗓️ 23 Jul 2026 09:33:57Reported by WordfenceType

CVE-2026-13009: AI Copilot plugin up to 1.5.4 allows authenticated subscribers to inject SQL via order[0][dir].

Reporter	Title	Published	Views	Family All 3
CVE	CVE-2026-13009	23 Jul 202609:33	–	cve
EUVD	EUVD-2026-47902	23 Jul 202609:33	–	euvd
NVD	CVE-2026-13009	23 Jul 202610:16	–	nvd

[
  {
    "vendor": "wupsales",
    "product": "AI Copilot – Content Generator",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.5.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2a965a23-5594-4925-8104-6f387a60ab49
plugins	www.plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workspace/models/tasks.php
plugins	www.plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workspace/controller.php
plugins	www.plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/model.php
plugins	www.plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/table.php
plugins	www.plugins.trac.wordpress.org/changeset

23 Jul 2026 09:33Current

CVSS 3.16.5

CWE-89