CVE-2026-57646
MediumCVSS 5.4Summary
Insecure Direct Object References (IDOR) vulnerability in Majestic Support versions up to 1.1.7 allows subscribers to access other users' resources by manipulating object identifiers.
Risk Assessment
An attacker with subscriber privileges can access sensitive data of other users, leading to privacy breaches and potential privilege escalation.
Recommendation
Immediately update the Majestic Support plugin to the latest available version that fixes this vulnerability and implement proper access control mechanisms.
Other vulnerabilities in Majestic Support <= 1.1.7
See all- CVE-2026-102382Medium
The Majestic Support plugin for WordPress contains an Authorization Bypass Through User-Controlled Key vulnerability in versions up to and including 1.2.0. Incorrectly configured access control levels may allow unauthorized access to resources.
- CVE-2026-102381Medium
The Majestic Support plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 1.2.0. Incorrectly configured access control levels may allow unauthorized users to perform operations they are not permitted to.
- CVE-2026-13262Medium
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress is vulnerable to generic SQL injection via the 'val' parameter in versions up to and including 1.1.9 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
Original NVD description (English source)
Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS