The vulnerability is an Insecure Direct Object Reference (IDOR) that exists in the WordPress Majestic Support plugin versions up to 1.1.7. It allows a subscriber-level user to access, view, or potentially modify any data object whose identifier is exposed by the plugin, thereby compromising the confidentiality and integrity of subscriber information. The weakness is identified as CWE‑639 and does not lead to remote code execution, but it enables an attacker to obtain information that should be restricted to other subscribers or administrators.

The affected software is the WordPress plugin Majestic Support, versions 1.1.7 and earlier. Any WordPress installation that has a vulnerable instance of this plugin is at risk.

The CVSS score of 5.4 indicates a moderate severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker with subscriber access or an unauthenticated user that can predict or construct object identifiers used by the plugin. Because the flaw is an IDOR, exploitation does not require advanced skills, but it does require the ability to interact with the plugin’s URLs.