What is the CVSS score of CVE-2026-57646?

CVE-2026-57646 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Majestic Support CVE-2026-57646

EUVD-2026-39761 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-5qpv-3mxm-5v8r

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable plugin endpoint, no complexity beyond holding a subscriber account (PR:L), with read/write limited to plugin-managed objects only; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:11 vuln.today

DescriptionCVE.org

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the Majestic Support WordPress plugin (versions up to and including 1.1.7) allows any authenticated subscriber-level user to access or modify support objects belonging to other users by manipulating user-controlled resource identifiers. Reported by Patchstack's audit team and tracked as EUVD-2026-39761, the flaw carries a CVSS 5.4 Medium rating with both confidentiality and integrity impact confirmed. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and broad attacker pool (any registered WordPress user) make it a meaningful risk on multi-tenant or customer-facing WordPress installations running this plugin.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of flaws where an application uses a user-supplied identifier - such as a numeric ticket ID or object reference in a URL or POST parameter - to retrieve or modify a resource without verifying that the requesting user is the legitimate owner or has authorization. In the context of a WordPress support plugin like Majestic Support, this typically manifests in endpoints that handle support tickets, attachments, or conversation threads: a subscriber can substitute another user's ticket ID in the request and the server fulfills the action without an ownership check. The CVSS vector AV:N/AC:L/PR:L confirms the flaw is remotely exploitable with no special conditions beyond holding a low-privilege (subscriber) WordPress account. Affected CPE data identifies the plugin at versions up to and including 1.1.7.

RemediationAI

No vendor-released patched version is independently confirmed from the available data - the EUVD record does not list a fixed release. Site administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-1-7-insecure-direct-object-references-idor-vulnerability for the latest patch status and upgrade guidance. If an updated plugin version is available in the WordPress plugin repository, upgrading immediately is the primary remediation. As a compensating control while awaiting a patch, administrators should disable open user registration if it is not operationally required, reducing the pool of potential attackers to already-trusted accounts. Additionally, a web application firewall rule restricting manipulation of ticket or object ID parameters in requests to the plugin's endpoints can reduce automated exploitation risk, though this may affect legitimate users navigating between their own tickets. Deactivating the plugin entirely is a last-resort option if exposure is unacceptable and no patch is available.