Majestic Support CVE-2026-102382

Requires an authenticated low-privilege WordPress account (PR:L) on a site running the Majestic Support plugin version 1.2.0 or earlier; the plugin must expose an endpoint that accepts a user-controlled object identifier without validating ownership or access-level permissions. No user interaction by a victim is needed (UI:N). Limiting factors: exploitation is gated on having valid login credentials and on the plugin being installed and active; impact is confined to integrity (unauthorized state changes on other users' support objects) with no confidentiality or availability effect per the vendor vector.

This is a modest-severity authorization flaw, not an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) describes a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privilege account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. The 4.3 base score and I:L-only impact indicate an unauthorized state change on another user's object rather than data theft or takeover. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided - there is no public exploit identified at time of analysis. SSVC framing: exploitation is unproven, technical impact is partial, and the authentication gate makes mass automation harder. One notable tension: the IDOR/user-controlled-key pattern in CWE-639 typically implies information disclosure (C:L), yet the vendor vector sets C:N and scores only I:L - suggesting the bug permits modifying/acting on other users' support records rather than reading them; this impact asymmetry is worth confirming with the vendor. There is no conflict between the stated network vector and the description. Overall: a real but low-priority bug that should be patched in the normal cycle, especially given it requires an existing authenticated foothold.

An attacker with a low-privilege authenticated account on a WordPress site running Majestic Support ≤1.2.0 manipulates a user-controlled identifier (e.g., a ticket or object ID) in a plugin request to reference records belonging to other users. Because access control levels are incorrectly enforced, the server performs the action on the targeted object, letting the attacker alter support data they should not control. No public exploit code is known, but the low attack complexity makes manual exploitation straightforward for any registered user.