The vulnerable Majestic Support plugin for WordPress contains a missing authorization flaw that allows users to access functionality they should not be able to use. This weakness can enable unauthorized use of plugin features, potentially exposing sensitive data or allowing unintended actions, thereby compromising the integrity and confidentiality of the WordPress installation. The vulnerability is identified as CWE‑862, indicating improper authorization controls.

Any WordPress site running Ahmad:Majestic Support plugin version 1.2.1 or earlier is affected. The issue applies to all installations that have not upgraded beyond the stated maximum version, regardless of the site’s role configuration.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, implying no reported active exploitation. Based on the description it is inferred that the attack vector likely requires access to the plugin’s internal routes or API endpoints, which may be reachable by authenticated or unauthenticated users depending on the site's configuration. The risk remains significant enough to warrant patching, especially if the plugin is exposed to public traffic.