The vulnerability resides in the Ahmad Majestic Support WordPress plugin, where the handling of user‑controlled identifiers fails to enforce proper access control. An attacker who knows or can guess a valid object key can perform a direct object reference and retrieve arbitrary data or resources beyond their privilege level. The impact therefore is the potential exposure of confidential information or the manipulation of protected content without proper authorization. The weakness corresponds to CWE‑639, rooted in insufficient authorization checks on user input.

WordPress installations employing Ahmad Majestic Support plugin versions up to and including 1.2.0 are affected. All environments running the plugin at these versions or older are susceptible to the IDOR flaw.

The CVSS score of 4.3 indicates medium severity for this issue. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited public exploitation evidence so far. The likely attack vector would involve manipulating the URL or form parameters to reference objects not owned by the current user. Successful exploitation requires only that the attacker has sufficient network or web access to the affected WordPress site and can supply a valid object key.