Majestic Support EUVD-2026-108077

The affected product is the Majestic Support WordPress plugin, versions n/a through 1.2.1; a vulnerable version must be installed and active on a network-reachable WordPress site. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required and exploitation works against default access-control configuration of the plugin. The description attributes the flaw to incorrectly configured access-control security levels but does not name the exact feature, endpoint, or request, so the precise trigger is not described in the available sources. Impact is limited to integrity (C:N/A:N), bounding the realistic consequence to unauthorized modification rather than data disclosure or denial of service.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WordPress plugin Majestic Support, affecting versions up to and including 1.2.1. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity issue requiring no privileges or user interaction, but with impact limited to integrity (I:L) - no confidentiality or availability loss. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which is consistent with a medium-impact access-control bug rather than a critical one. No EPSS score, no CISA KEV listing, and no verified public exploit are present in the input; the sole reference is the Patchstack advisory that catalogs the issue. Taken together the signals are internally consistent: a real but bounded issue worth scheduled remediation rather than emergency patching. Note the Tags label this 'Authentication Bypass' whereas the CWE and description describe missing authorization (broken access control) - these are related but distinct classes; treat the mechanism as an authorization gap, not credential bypass.

A remote attacker sends a direct request to a Majestic Support plugin endpoint that fails to enforce proper access-control checks, allowing an action normally restricted to be performed without the required authorization, resulting in limited unauthorized modification of data (I:L). The exact feature and request are not described in the available sources. No public exploit code is identified at time of analysis.