CVE-2026-13009: The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Param

The AI Copilot – Content Generator plugin for WordPress has a SQL injection vulnerability (a weakness that lets attackers insert malicious database commands) in versions up to 1.5.4 through the 'order[0][dir]' parameter. Authenticated attackers with subscriber-level access or higher can exploit this to extract sensitive information from the database because the plugin fails to properly filter user input before using it in database queries.