What is CVE-2026-57646?

CVE-2026-57646 is an Insecure Direct Object Reference (IDOR) vulnerability in the Majestic Support plugin for WordPress, affecting versions up to and including 1.1.7. It allows authenticated attackers with Subscriber-level access to perform unauthorized actions, such as using the AI-powered reply feature on tickets they should not have access to.

How does the vulnerability work?

The vulnerability exists in the file /modules/ticket/model.php, where the AI-powered reply feature lacks proper permission checks. An authenticated Subscriber can send a crafted AJAX request to admin-ajax.php with a ticketId parameter, and the server processes the request without verifying the user’s role, allowing unauthorized access to ticket data and AI reply functionality.

What is the root cause of this vulnerability?

The root cause is missing access control validation on a user-controlled key in the AI reply handler. In version 1.1.7, the code at line 3209 did not check if the user had permission to use the feature, allowing any authenticated user to invoke it. The patch adds a three-tier check that blocks standard users.

Who is affected by CVE-2026-57646?

Any WordPress site running the Majestic Support plugin version 1.1.7 or earlier is affected. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability. Sites with only Administrator-level users are still vulnerable but require a Subscriber account to exploit.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 1.1.7 or lower, your site is vulnerable. You can also verify by looking at the version string in the plugin’s main file (majestic-support.php) or the database option ‘versioncode’.

What is the CVSS score and severity?

The CVSS score is 4.3, classified as Medium severity. This indicates a moderate risk where exploitation requires authentication but can lead to unauthorized data exposure. The impact is limited to reading and generating replies on tickets, not full system compromise.

How can I fix or mitigate this vulnerability?

Update the Majestic Support plugin to version 1.1.8 or later, which includes the security patch. As a temporary mitigation, you can disable the AI-powered reply feature or restrict Subscriber accounts to only trusted users. Ensure all user roles have minimal necessary permissions.

What does the proof of concept demonstrate?

The proof of concept shows that an authenticated Subscriber can send a POST request to admin-ajax.php with the action parameter set to the vulnerable AJAX handler and a ticketId. The server returns the AI-generated reply for that ticket, confirming unauthorized access. The exact action name is not public but can be inferred from the plugin code.

What is the impact of successful exploitation?

An attacker can view and generate AI-powered replies for any ticket, potentially exposing sensitive customer information. This could lead to data breaches, social engineering attacks, or privilege escalation within the support system. However, the attacker cannot modify tickets or access admin functions.

How does the patch fix the vulnerability?

The patch adds a permission check before the AI reply logic executes. It allows only administrators and agents with the ‘Use AI Powered Reply Feature’ permission to access the feature. All other users, including Subscribers, are denied with an error message. The code diff shows the insertion of a new access control block at lines 3212-3236.

Is there a workaround if I cannot update immediately?

If you cannot update to version 1.1.8, consider disabling the AI-powered reply feature by removing or renaming the relevant code in the plugin. Alternatively, restrict Subscriber accounts to only trusted users and monitor for unusual AJAX requests to admin-ajax.php. However, updating is the recommended action.

Where can I find more information about this CVE?

Refer to the official CVE entry at cve.mitre.org or the WordPress plugin changelog. The plugin’s support forum and the Atomic Edge analysis provide detailed technical information. Always verify patches from the official plugin source.

Published : July 4, 2026

CVE-2026-57646: Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule

CVE ID CVE-2026-57646

Plugin majestic-support

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 1.1.7

Patched Version 1.1.8

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57646:

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Majestic Support plugin for WordPress, affecting versions up to and including 1.1.7. The flaw allows authenticated attackers with Subscriber-level access to perform unauthorized actions by exploiting a missing access control check in the AI-powered reply feature. The CVSS score is 4.3.

Root Cause: The vulnerability resides in the file /modules/ticket/model.php, specifically in the function handling the AI-powered reply feature. In the vulnerable version, the code at line 3209 lacked any permission verification before processing requests. The patch introduces a strict access control block that checks if the user is an admin, an agent with the required AI permission, or denies access otherwise. The diff shows the insertion of a new security check at lines 3212-3236 that explicitly blocks standard users (including Subscribers) from accessing the AI reply functionality.

Exploitation: An authenticated attacker with Subscriber-level privileges can send a crafted AJAX request to the WordPress admin-ajax.php endpoint with the action parameter set to the vulnerable handler (likely ‘majestic_support_ai_reply’ or similar) and a ticketId parameter. The server processes the request without verifying that the user has the necessary permissions, allowing the attacker to invoke the AI reply feature on any ticket. The precise AJAX action name was not provided in the diff, but it is triggered by the code path that calls the vulnerable model method.

Patch Analysis: The patch adds a three-tier access control check before the AI reply logic executes. Admin users retain full access. Agents must have the ‘Use AI Powered Reply Feature’ permission granted via the plugin’s user permissions system. All other users, including Subscribers, are blocked with an error message. This directly addresses the missing authorization by verifying the user’s role and permissions before processing the request.

Impact: Successful exploitation allows an authenticated Subscriber to use the AI-powered reply feature on tickets, potentially viewing and generating replies for tickets they should not have access to. This leads to unauthorized data exposure and could facilitate further social engineering or privilege escalation within the support system.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/majestic-support/includes/activation.php
+++ b/majestic-support/includes/activation.php
@@ -183,8 +183,8 @@
                     ('tplink_tickets_user', '1', 'tplink', NULL),
                     ('show_breadcrumbs', '1', 'default', NULL),
                     ('productcode', 'mjsupport', 'default', NULL),
-                    ('versioncode', '1.1.7', 'default', NULL),
-                    ('productversion', '117', 'default', NULL),
+                    ('versioncode', '1.1.8', 'default', NULL),
+                    ('productversion', '118', 'default', NULL),
                     ('producttype', 'free', 'default', NULL),
                     ('tve_enabled', '2', 'default', NULL),
                     ('tve_mailreadtype', '3', 'default', NULL),
--- a/majestic-support/majestic-support.php
+++ b/majestic-support/majestic-support.php
@@ -5,7 +5,7 @@
   Plugin URI: https://www.majesticsupport.com
   Description: Majestic Support is a trusted open source ticket system. Majestic Support is a simple, easy to use, web-based customer support system. User can create ticket from front-end. Majestic Support comes packed with lot features than most of the expensive(and complex) support ticket system on market. Majestic Support provide you best industry Majestic Support system.
   Author: Majestic Support
-  Version: 1.1.7
+  Version: 1.1.8
   License: GPLv3
   Text Domain: majestic-support
   Domain Path: /languages
@@ -62,7 +62,7 @@
         self::$_data = array();
         self::$_search = array();
         self::$_captcha = array();
-        self::$_currentversion = '117';
+        self::$_currentversion = '118';
         self::$_addon_query = array('select'=>'','join'=>'','where'=>'');
         self::$_mjtcsession = MJTC_includer::MJTC_getObjectClass('wphdsession');
         global $wpdb;
@@ -1435,7 +1435,7 @@
             if( $MJTC_plugin == $MJTC_our_plugin ) {
                 update_option('ms_currentversion', majesticsupport::$_currentversion);
                 include_once MJTC_PLUGIN_PATH . 'includes/updates/updates.php';
-                MJTC_updates::MJTC_checkUpdates('117');
+                MJTC_updates::MJTC_checkUpdates('118');
                 MJTC_includer::MJTC_getModel('majesticsupport')->updateColorFile();
                 MJTC_includer::MJTC_getModel('majesticsupport')->mjtc_check_license_status();
                 MJTC_includer::MJTC_getModel('premiumplugin')->MSAddonsAutoUpdate();
--- a/majestic-support/modules/majesticsupport/controller.php
+++ b/majestic-support/modules/majesticsupport/controller.php
@@ -22,7 +22,7 @@
                 case 'controlpanel':
                     MJTC_includer::MJTC_getModel('majesticsupport')->getControlPanelData();
                     include_once MJTC_PLUGIN_PATH . 'includes/updates/updates.php';
-                    MJTC_updates::MJTC_checkUpdates('117');
+                    MJTC_updates::MJTC_checkUpdates('118');
                     MJTC_includer::MJTC_getModel('majesticsupport')->updateColorFile();
                     break;
                 case 'admin_shortcodes':
--- a/majestic-support/modules/ticket/model.php
+++ b/majestic-support/modules/ticket/model.php
@@ -3209,13 +3209,36 @@
             die('Security check Failed');
         }

+        // --- SECURITY CHECK: STRICT ACCESS CONTROL ---
+        // 1. Check if user is Admin
+        $is_admin = current_user_can('manage_options');
+
+        // 2. Check if user is an Agent
+        $is_agent = (in_array('agent', majesticsupport::$_active_addons) && MJTC_includer::MJTC_getModel('agent')->isUserStaff());
+
+        if ($is_admin) {
+            // Admins pass automatically (No permission check needed)
+        } elseif ($is_agent) {
+            // Agents must have the specific AI permission granted
+            if (!MJTC_includer::MJTC_getModel('userpermissions')->MJTC_checkPermissionGrantedForTask('Use AI Powered Reply Feature')) {
+                die(json_encode(['error' => 'Permission denied. Agent lacks AI Reply privilege.']));
+            }
+        } else {
+            // Standard users/Subscribers (like the attacker in the WP report) are blocked completely
+            die(json_encode(['error' => 'Permission denied. Only staff can access this feature.']));
+        }
+        // -------------------------------------------------
+
         $MJTC_id = absint(MJTC_request::MJTC_getVar('ticketId'));
         $MJTC_subject = sanitize_text_field(MJTC_request::MJTC_getVar('ticketSubject'));
         // Set a limit for smart replies, similar to how you had it in your separate query
         $MJTC_limit = 5; // You can adjust this limit as needed

         $MJTC_agentquery = "";
-        if (in_array('agent', majesticsupport::$_active_addons) && MJTC_includer::MJTC_getModel('agent')->isUserStaff()) {
+
+        // We already know the user is either Admin or Agent if they reached here.
+        // If they are an Agent, apply the assignment limitations if configured.
+        if ($is_agent && !$is_admin) {
             $MJTC_allowed = MJTC_includer::MJTC_getModel('userpermissions')->MJTC_checkPermissionGrantedForTask('Limit AI Replies to Agent-Assigned Tickets');
             if ($MJTC_allowed) {
                 $MJTC_staffid = absint(MJTC_includer::MJTC_getModel('agent')->getStaffId(MJTC_includer::MJTC_getObjectClass('user')->MJTC_uid()));

Frequently Asked Questions

What is CVE-2026-57646?
Vulnerability Overview
CVE-2026-57646 is an Insecure Direct Object Reference (IDOR) vulnerability in the Majestic Support plugin for WordPress, affecting versions up to and including 1.1.7. It allows authenticated attackers with Subscriber-level access to perform unauthorized actions, such as using the AI-powered reply feature on tickets they should not have access to.
How does the vulnerability work?
Technical Explanation
The vulnerability exists in the file /modules/ticket/model.php, where the AI-powered reply feature lacks proper permission checks. An authenticated Subscriber can send a crafted AJAX request to admin-ajax.php with a ticketId parameter, and the server processes the request without verifying the user’s role, allowing unauthorized access to ticket data and AI reply functionality.
What is the root cause of this vulnerability?
Root Cause Analysis
The root cause is missing access control validation on a user-controlled key in the AI reply handler. In version 1.1.7, the code at line 3209 did not check if the user had permission to use the feature, allowing any authenticated user to invoke it. The patch adds a three-tier check that blocks standard users.
Who is affected by CVE-2026-57646?
Affected Users
Any WordPress site running the Majestic Support plugin version 1.1.7 or earlier is affected. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability. Sites with only Administrator-level users are still vulnerable but require a Subscriber account to exploit.
How can I check if my site is vulnerable?
Detection Method
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 1.1.7 or lower, your site is vulnerable. You can also verify by looking at the version string in the plugin’s main file (majestic-support.php) or the database option ‘versioncode’.
What is the CVSS score and severity?
Risk Assessment
The CVSS score is 4.3, classified as Medium severity. This indicates a moderate risk where exploitation requires authentication but can lead to unauthorized data exposure. The impact is limited to reading and generating replies on tickets, not full system compromise.
How can I fix or mitigate this vulnerability?
Remediation Steps
Update the Majestic Support plugin to version 1.1.8 or later, which includes the security patch. As a temporary mitigation, you can disable the AI-powered reply feature or restrict Subscriber accounts to only trusted users. Ensure all user roles have minimal necessary permissions.
What does the proof of concept demonstrate?
PoC Explanation
The proof of concept shows that an authenticated Subscriber can send a POST request to admin-ajax.php with the action parameter set to the vulnerable AJAX handler and a ticketId. The server returns the AI-generated reply for that ticket, confirming unauthorized access. The exact action name is not public but can be inferred from the plugin code.
What is the impact of successful exploitation?
Impact Analysis
An attacker can view and generate AI-powered replies for any ticket, potentially exposing sensitive customer information. This could lead to data breaches, social engineering attacks, or privilege escalation within the support system. However, the attacker cannot modify tickets or access admin functions.
How does the patch fix the vulnerability?
Patch Details
The patch adds a permission check before the AI reply logic executes. It allows only administrators and agents with the ‘Use AI Powered Reply Feature’ permission to access the feature. All other users, including Subscribers, are denied with an error message. The code diff shows the insertion of a new access control block at lines 3212-3236.
Is there a workaround if I cannot update immediately?
Temporary Workaround
If you cannot update to version 1.1.8, consider disabling the AI-powered reply feature by removing or renaming the relevant code in the plugin. Alternatively, restrict Subscriber accounts to only trusted users and monitor for unusual AJAX requests to admin-ajax.php. However, updating is the recommended action.
Where can I find more information about this CVE?
Additional Resources
Refer to the official CVE entry at cve.mitre.org or the WordPress plugin changelog. The plugin’s support forum and the Atomic Edge analysis provide detailed technical information. Always verify patches from the official plugin source.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started