CVE-2025-49860: Majestic Support Auth Bypass Vulnerability

CVE-2025-49860 Overview

CVE-2025-49860 is a Missing Authorization vulnerability [CWE-862] affecting the Majestic Support WordPress plugin. The flaw affects all versions of majestic-support up to and including 1.1.0. Unauthenticated attackers can reach functionality that should require proper authorization checks, exposing information from the plugin's support ticketing system.

The vulnerability is exploitable over the network without user interaction or prior authentication. It carries a CVSS 3.1 base score of 5.3, with impact limited to confidentiality. Site operators running the affected plugin should treat this as a broken access control issue with realistic exposure of low-sensitivity data through the support module.

Critical Impact
Unauthenticated network-based access to protected plugin functionality due to missing authorization checks, leading to disclosure of information handled by the Majestic Support plugin.

Affected Products

Majestic Support plugin for WordPress (majestic-support)
All versions from n/a through 1.1.0
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-09-09 - CVE-2025-49860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49860

Vulnerability Analysis

The vulnerability stems from a Missing Authorization weakness [CWE-862] within the Majestic Support plugin. Endpoints that expose plugin functionality do not verify whether the requesting user holds the capability required to invoke them. As a result, requests reach protected code paths without an access control gate.

The attack vector is network-based with low complexity. No privileges and no user interaction are required. Impact is limited to confidentiality, with no direct integrity or availability effect reported. This aligns with typical broken access control issues in WordPress plugins where handlers rely on knowledge of the endpoint name rather than a capability check such as current_user_can() or a nonce verification through check_ajax_referer().

The EPSS score is 0.27%, indicating a low modeled probability of exploitation activity in the near term. However, unauthenticated broken access control issues in publicly indexed WordPress plugins are routinely targeted by automated scanners.

Root Cause

The root cause is the absence of authorization enforcement on plugin action handlers up to version 1.1.0. Handlers registered through WordPress hooks such as admin-ajax.php actions or REST routes execute without validating the caller's role, capability, or ownership context. This allows unauthenticated requests to invoke functions intended for privileged users of the support ticketing workflow.

Attack Vector

An attacker sends crafted HTTP requests directly to the exposed plugin endpoints on a target WordPress site. Because the handlers do not verify authorization, the server processes the requests and returns data that should be restricted. Exploitation does not require credentials, session tokens, or interaction from a legitimate user. Refer to the Patchstack Vulnerability Report for endpoint-level detail.

Detection Methods for CVE-2025-49860

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing Majestic Support actions from unfamiliar IP addresses.
Requests to plugin-specific REST routes or handler paths under /wp-content/plugins/majestic-support/ returning HTTP 200 without an authenticated session cookie.
Bursts of automated scanning traffic enumerating plugin actions across the site.

Detection Strategies

Inspect web server and WordPress access logs for anonymous requests hitting Majestic Support action handlers.
Correlate admin-ajax.php calls that include Majestic Support action parameters with absent or invalid wordpress_logged_in_* cookies.
Alert on responses to unauthenticated clients that contain support ticket identifiers, email addresses, or ticket metadata.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that flags anonymous access to plugin AJAX and REST endpoints.
Track request rate and response size anomalies for admin-ajax.php and plugin REST namespaces.
Retain WordPress and reverse proxy logs long enough to reconstruct pre-patch access to the vulnerable plugin endpoints.

How to Mitigate CVE-2025-49860

Immediate Actions Required

Identify all WordPress sites running the majestic-support plugin and confirm installed version.
Deactivate the plugin on sites where it is not actively required until a fixed version is available.
Restrict access to wp-admin/admin-ajax.php and plugin REST routes at the WAF layer for unauthenticated clients where feasible.

Patch Information

As of the last NVD update on 2026-06-17, the advisory tracks the issue as affecting versions through 1.1.0. Consult the Patchstack Vulnerability Report for the latest fixed version guidance and vendor updates. Apply the vendor-supplied patch as soon as it is available and verify by re-scanning the site.

Workarounds

Deactivate and remove the Majestic Support plugin until a patched release is deployed.
Deploy a virtual patch through a WordPress WAF or reverse proxy that blocks unauthenticated calls to Majestic Support action names and REST routes.
Limit access to the WordPress site to trusted networks where the support ticketing workflow is used only internally.

bash

# Example nginx snippet to block unauthenticated access to the plugin directory
location ~* /wp-content/plugins/majestic-support/ {
    # Allow only authenticated sessions by requiring the WordPress login cookie
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}