Majestic Support CVE-2026-102381

The target must run WordPress with the Majestic Support plugin installed and active at a version from n/a through 1.2.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, low-complexity, and requires no user interaction against default configurations - the description frames it as 'Incorrectly Configured Access Control Security Levels,' i.e. a plugin endpoint that omits an authorization check. The practical LIMIT on risk is impact scope: only a LOW integrity effect (C:N/A:N), meaning the attacker can perform an unauthorized action/state change but cannot read confidential data or cause outage; the plugin's small deployment footprint and absence of a published POC further constrain real-world exploitation.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium) describes a remotely reachable, low-complexity, unauthenticated missing-authorization flaw (CWE-862) whose only impact is a LOW integrity effect - no confidentiality and no availability loss. The 5.3 is driven entirely by PR:N (no auth) rather than by impact, so despite the 'Medium' label the real-world severity is bounded: an attacker can perform some unauthorized state change or action the plugin should have gated, but cannot read sensitive data or take down the site. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the only source is a single Patchstack database entry. The dominant mitigating signal is prevalence: Majestic Support is a niche WordPress helpdesk plugin with a small deployment footprint, which further lowers attacker interest versus a mass-market plugin. Note the 'Authentication Bypass' tag conflicts with the actual CWE-862 (missing authorization is a post-authentication/authorization-logic flaw, not credential/authentication bypass) - treat the tag as imprecise.

An unauthenticated remote attacker sends a crafted HTTP request directly to a Majestic Support plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization level, triggering an unauthorized state-changing operation on a WordPress site running the plugin at version ≤1.2.0. Because no authentication or user interaction is required, the request can be issued directly against default installs, though impact is limited to the integrity of whatever data or action the vulnerable endpoint controls. No public exploit code was identified at the time of analysis.