CVE-2026-102381: Majestic Support Auth Bypass Vulnerability

CVE-2026-102381 Overview

CVE-2026-102381 is a Missing Authorization vulnerability [CWE-862] in the Ahmad Majestic Support majestic-support WordPress plugin. The flaw affects all plugin versions up to and including 1.2.0. Attackers can exploit incorrectly configured access control security levels to interact with functionality that should be restricted to authorized users.

The vulnerability is network-exploitable, requires no authentication, and no user interaction. Successful exploitation results in limited integrity impact without affecting confidentiality or availability of the host WordPress site.

Critical Impact

Unauthenticated attackers can invoke protected plugin actions, modifying support ticket data or related state within WordPress sites running Majestic Support 1.2.0 or earlier.

Affected Products

• Ahmad Majestic Support plugin for WordPress
• All versions from unspecified initial release through 1.2.0
• WordPress sites with the majestic-support plugin installed and active

Discovery Timeline

• 2026-10-01 - CVE-2026-102381 published to the National Vulnerability Database (NVD)
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-102381

Vulnerability Analysis

The vulnerability is classified under CWE-862: Missing Authorization. The Majestic Support plugin exposes functionality that fails to verify whether the requesting user holds the privileges required to perform the action. WordPress plugins typically enforce authorization through capability checks such as current_user_can() or nonce validation via check_ajax_referer(). When these checks are missing or incorrectly configured, any visitor to the site can invoke the affected endpoints.

Because the attack vector is network-based and no privileges are required, exploitation can be performed remotely against any reachable WordPress installation with the plugin enabled. The impact is bounded to integrity: an attacker can alter data accessible through the exposed handlers but cannot read protected secrets or disrupt service through this flaw alone.

Root Cause

The root cause is incorrectly configured access control security levels within handler routes registered by the plugin. Specific handler names and parameter structures are not disclosed in the public advisory. Refer to the Patchstack Vulnerability Report for technical specifics.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to WordPress endpoints registered by the Majestic Support plugin. Because authorization is not enforced on the targeted handlers, the server processes the request as if it originated from a privileged user. No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-102381

Indicators of Compromise

• Unauthenticated POST or GET requests to admin-ajax.php or REST routes containing majestic-support or majestic_support action parameters.
• Unexpected creation, modification, or deletion of support tickets, agent assignments, or related plugin data without a corresponding authenticated administrator session.
• Access log entries showing bursts of requests to plugin endpoints from a single external IP address.

Detection Strategies

• Audit the installed version of the Majestic Support plugin across all WordPress instances and flag any at 1.2.0 or earlier.
• Correlate web server access logs with WordPress authentication logs to identify plugin endpoint access by unauthenticated sessions.
• Deploy web application firewall (WAF) rules that inspect request paths and parameters associated with the plugin and alert on anonymous invocation.

Monitoring Recommendations

• Enable verbose logging on the WordPress site for AJAX and REST API routes exposed by the plugin.
• Monitor file integrity and database tables used by Majestic Support for unexpected changes.
• Alert on new or modified administrator-equivalent records created outside documented change windows.

How to Mitigate CVE-2026-102381

Immediate Actions Required

• Identify all WordPress sites running the Majestic Support plugin at version 1.2.0 or earlier.
• Deactivate the plugin on affected sites until a vendor-supplied patched release is confirmed installed.
• Restrict access to the WordPress admin surface and plugin endpoints using IP allowlisting or WAF policies where feasible.
• Review support ticket data and plugin-managed records for unauthorized changes.

Patch Information

No fixed version is listed in the published advisory at the time of writing. Administrators should monitor the Patchstack Vulnerability Report and the plugin's distribution channel for a release that addresses CVE-2026-102381.

Workarounds

• Deactivate and remove the Majestic Support plugin until a patched version is available.
• Apply WAF rules that block unauthenticated requests to admin-ajax.php and REST endpoints referencing majestic-support or majestic_support actions.
• Enforce authentication at the web server or reverse proxy layer for plugin-managed URLs where business workflows allow.

# Example nginx rule to block anonymous access to Majestic Support AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "majestic[_-]support") {
        return 403;
    }
}