CVE-2026-57646: Majestic Support IDOR Vulnerability

CVE-2026-57646 Overview

CVE-2026-57646 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Majestic Support plugin for WordPress in versions up to and including 1.1.7. The flaw allows authenticated users with subscriber-level privileges to access or manipulate objects belonging to other users by directly referencing their identifiers. The weakness is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A low-privileged subscriber account can bypass authorization controls to read or modify support ticket data belonging to other users, resulting in confidentiality and integrity loss.

Affected Products

Majestic Support WordPress plugin versions <= 1.1.7
WordPress sites using the Majestic Support helpdesk plugin
Any environment where subscriber-level registration is permitted alongside the vulnerable plugin

Discovery Timeline

2026-06-26 - CVE-2026-57646 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57646

Vulnerability Analysis

The Majestic Support plugin exposes functionality that references support objects, such as tickets or attachments, using predictable identifiers passed through user-controlled parameters. The plugin fails to verify that the authenticated requester owns or has authorization to interact with the referenced object. A subscriber can enumerate or guess object identifiers and issue requests that the application processes without checking ownership.

The issue affects confidentiality and integrity at a limited scope because the attacker requires an authenticated account and the exposed data is constrained to plugin-managed resources. Availability is not directly impacted. The EPSS data indicates a low near-term probability of observed exploitation activity.

Root Cause

The root cause is missing authorization checks on request handlers that accept object identifiers from the client. The plugin trusts the identifier supplied in the request and retrieves the matching record without validating that the current subscriber owns it. This pattern is the defining characteristic of CWE-639 and appears in plugin endpoints that manage user-scoped support data.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid authenticated subscriber account. The attacker enumerates or modifies numeric or otherwise predictable identifiers in requests sent to Majestic Support endpoints. The server returns or updates the target object without checking ownership, disclosing another user's support data or allowing tampering with it. No user interaction from the victim is required.

Refer to the Patchstack Vulnerability Report for the specific parameters and endpoints involved.

Detection Methods for CVE-2026-57646

Indicators of Compromise

Repeated authenticated requests to Majestic Support endpoints from a single subscriber account, iterating over sequential identifier values.
WordPress access logs showing requests to plugin action handlers with identifier parameters that do not correspond to the requesting user's records.
Unexpected views or modifications of support tickets attributed to accounts that did not create them.

Detection Strategies

Correlate WordPress user session data with plugin request parameters to flag mismatches between the requesting user and the accessed object owner.
Deploy web application firewall rules that rate-limit or alert on identifier enumeration patterns against Majestic Support URLs.
Review database audit logs for support ticket reads or updates initiated by subscriber-role accounts outside their expected activity baseline.

Monitoring Recommendations

Enable verbose logging on the Majestic Support plugin and forward WordPress request logs to a central analytics platform.
Alert on high volumes of 4xx and 2xx responses from plugin endpoints when the requesting role is subscriber.
Track new subscriber registrations followed by immediate access to support ticket endpoints as a suspicious behavior pattern.

How to Mitigate CVE-2026-57646

Immediate Actions Required

Upgrade the Majestic Support plugin to a version later than 1.1.7 once the vendor publishes a patched release.
Audit existing subscriber accounts and remove or disable any that are not required for site operation.
Review support ticket access logs for evidence of unauthorized reads or modifications since the plugin was installed.

Patch Information

Consult the Patchstack Vulnerability Report for the current patch status and fixed version. No fixed version is listed in the NVD entry at the time of publication. Apply the vendor update as soon as it is available through the WordPress plugin repository.

Workarounds

Disable open user registration on the affected WordPress site to prevent adversaries from obtaining subscriber accounts.
Restrict access to Majestic Support endpoints using web server or WAF rules until a patched plugin version is installed.
Temporarily deactivate the Majestic Support plugin if the helpdesk functionality is not business-critical.

bash

# Example: block access to Majestic Support plugin endpoints via .htaccess until patched
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} /wp-content/plugins/majestic-support/ [NC]
  RewriteRule .* - [F,L]
</IfModule>