The Majestic Support plugin contains an SQL Injection flaw caused by failing to escape user input before using it in a database query, classified as CWE-89. An attacker could inject arbitrary SQL, leading to unauthorized data retrieval, modification, or deletion. The main consequence is the potential loss of data integrity or confidentiality; remote code execution is not directly supported by the CVE description and would require additional exploitation steps.

All WordPress sites that have installed the Majestic Support plugin 1.1.0 or earlier are vulnerable. Administrators should audit installations for this plugin version and determine whether it is present.

The high CVSS score of 9.3 indicates a severe vulnerability. The EPSS score of <1% suggests that, at present, exploitation has a low probability, but the risk is still significant if the vulnerable site is publicly accessible. The plugin is not listed in CISA's KEV catalog, implying no known widespread exploitation yet. The likely attack vector involves a malicious user sending a crafted HTTP request to an endpoint that uses the vulnerable query; this inference is drawn from the nature of the flaw described.