The vulnerability is a missing authorization flaw that allows an attacker to invoke plugin functionality without proper permission checks. Because the plugin does not enforce its internal access controls, an attacker could potentially access or modify data that should be restricted to trusted users. The weakness is classified as a broken access control issue (CWE-862).

The vulnerability affects the Majestic Support WordPress plugin version 1.1.0 and all earlier releases. The plugin can be present on any WordPress installation that has not upgraded past 1.1.0, so all sites using older versions are impacted.

The CVSS score of 5.3 indicates a medium risk rating, while the EPSS score of less than 1% shows that exploitation is unlikely to be observed in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the information, the likely attack vector is web‑based; an attacker can send specially crafted HTTP requests to the plugin’s endpoints to bypass authorization and reach protected functionality. No additional patron exploits or escalation steps are described, so the impact is confined to unauthorized access to plugin features.