Vulnerabilities and security researches formajestic-support majestic-support
Direction: ascendingFeb 13, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2024-13601
- CVE, Research URL
- Date
- Feb 12, 2025
- Research Description
- The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export ticket data for any user.
- Affected versions
-
max 1.0.6.
- Status
-
vulnerable
Feb 27, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2025-26985
- CVE, Research URL
- Date
- Feb 25, 2025
- Research Description
- Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.6.
- Affected versions
-
max 1.0.7.
- Status
-
vulnerable
May 07, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2024-13600
- CVE, Research URL
- Date
- Feb 12, 2025
- Research Description
- The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets.
- Affected versions
-
max 1.0.6.
- Status
-
vulnerable
Jun 14, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2025-48283
- CVE, Research URL
- Date
- May 23, 2025
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Affected versions
-
max 1.1.1.
- Status
-
vulnerable
Majestic Support – Help Desk & Support Plugin # CVE-2025-48282
- CVE, Research URL
- Date
- May 19, 2025
- Research Description
- Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Affected versions
-
max 1.1.1.
- Status
-
vulnerable
Jun 20, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2025-49860
- CVE, Research URL
- Date
- Sep 09, 2025
- Research Description
- Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Affected versions
-
max 1.1.1.
- Status
-
vulnerable
Nov 11, 2025
Majestic Support – Help Desk & Support Plugin # CVE-2025-64284
- CVE, Research URL
- Date
- Oct 29, 2025
- Research Description
- Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.7.
- Affected versions
-
max 1.0.8.
- Status
-
vulnerable
Apr 17, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-40778
- CVE, Research URL
- Date
- Apr 15, 2026
- Research Description
- Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.2.
- Affected versions
-
max 1.1.3.
- Status
-
vulnerable
Jul 01, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-57646
- CVE, Research URL
- Date
- Jun 26, 2026
- Research Description
- Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.
- Affected versions
-
max 1.1.8.
- Status
-
vulnerable
Jul 12, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-13262
- CVE, Research URL
- Date
- Jul 11, 2026
- Research Description
- The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.
- Affected versions
-
max 1.2.0.
- Status
-
vulnerable
Oct 06, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-102381
- CVE, Research URL
- Date
- Oct 01, 2026
- Research Description
- Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.
- Affected versions
-
max 1.2.1.
- Status
-
vulnerable
Majestic Support – Help Desk & Support Plugin # CVE-2026-102382
- CVE, Research URL
- Date
- Oct 01, 2026
- Research Description
- Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.
- Affected versions
-
max 1.2.1.
- Status
-
vulnerable
Oct 24, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-112218
- CVE, Research URL
- Date
- Oct 22, 2026
- Research Description
- Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.
- Affected versions
-
max 1.2.2.
- Status
-
vulnerable
Nov 01, 2026
Majestic Support – Help Desk & Support Plugin # CVE-2026-115820
- CVE, Research URL
- Date
- Oct 30, 2026
- Research Description
- The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Any authenticated WordPress user with Subscriber-level access can exploit this because the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately obtains from their own 'Add erase request' page.
- Affected versions
-
max 1.2.3.
- Status
-
vulnerable