Subscriber IDOR in Majestic Support <= 1.1.7

Executive Summary

The WordPress Majestic Support Plugin, versions 1.1.7 and below, contains an Insecure Direct Object References (IDOR) vulnerability. This security flaw allows attackers to bypass authorization and authentication controls, potentially gaining unauthorized access to sensitive files, folders, or database interactions.

Although classified as low severity with a CVSS score of 5.4, this vulnerability poses a risk especially in large-scale exploit campaigns targeting many websites.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass security mechanisms and access sensitive information or interact with the database without proper authorization.

• Unauthorized access to sensitive files and folders.
• Potential unauthorized database interactions.

While the severity is low, the risk increases in mass-exploit scenarios affecting many websites.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to bypass authorization and authentication mechanisms, potentially accessing sensitive files, folders, or interacting with the database.

Such unauthorized access to sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive information.

Therefore, if exploited, this vulnerability could negatively impact compliance with these common standards and regulations by exposing sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the WordPress Majestic Support Plugin versions 1.1.7 and below can be mitigated by updating the plugin to version 1.1.8 or later.

If updating immediately is not possible, it is recommended to seek assistance from a hosting provider or a web developer.

Additionally, Patchstack users can enable auto-updates for vulnerable plugins to automatically mitigate this issue.

Useful 0 Not Useful 0