Is Majestic Support safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.2.4). As of 2026-11-04. 14 issues are on record for older versions; version 1.2.3 or newer fixes all of them that state a fix. Keep Majestic Support on the latest version (1.2.4) and remove it if you do not use it.

Which versions of Majestic Support are vulnerable?

Known issues on record (newest first): SQL injection (1.2.2 and older, fixed in 1.2.3); Missing authorization check (1.2.1 and older, fixed in 1.2.2); Missing authorization check (1.2.0 and older, fixed in 1.2.1); SQL injection (1.1.9 and older, fixed in 1.2.0); Missing authorization check (1.1.7 and older, fixed in 1.1.8); Missing authorization check (1.1.2 and older, fixed in 1.1.3). The full list with sources is on this page.

What is the latest version of Majestic Support?

1.2.4, according to wordpress.org (last updated 2026-11-01). It has 3,000+ active installs.

What should I do if my Majestic Support is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update majestic-support). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · majestic-support · data as of 2026-11-04

Is Majestic Support safe? Known vulnerabilities and latest version

Latest version: 1.2.4
Last updated: 2026-11-01
Active installs: 3,000+
Known issues on record: 14
Unpatched in latest: 0
Tested up to WP: 7.0.8 · PHP 7.4+

Majestic Support for WordPress is a top-tier ticket system that can significantly enhance your customers' support experience. — by Majestic Support

What to do

Update to the latest version (1.2.4). Anything older than 1.2.3 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get majestic-support --field=version shows what you run; wp plugin update majestic-support updates it.

Check your version

Known vulnerabilities

14 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 6.5 CVE-2026-115820 · published 2026-10-30

SQL injection in Majestic Support (1.2.2 and older)

Affected: 1.2.2 and older
Fixed in: 1.2.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Any authenticated WordPress user with Subscriber-level access can exploit this because the 'saveusereraserequest' task is whitelisted for front-end customer use, the plugin auto-provisions a help-desk record for every WordPress account, and the only guard is a nonce the attacker legitimately obtains from their own 'Add erase request' page.

NVD CVE-2026-115820 Wordfence advisory downloads.wordpress.org Plugin source

medium 5.3 CVE-2026-112218 · published 2026-10-22

Missing authorization check in Majestic Support (1.2.1 and older)

Affected: 1.2.1 and older
Fixed in: 1.2.2
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.

NVD CVE-2026-112218 Patchstack advisory

medium 5.3 CVE-2026-102381 · published 2026-10-01

Missing authorization check in Majestic Support (1.2.0 and older)

Affected: 1.2.0 and older
Fixed in: 1.2.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2026-102381 Patchstack advisory

medium 4.3 CVE-2026-102382 · published 2026-10-01

Missing authorization check in Majestic Support (1.2.0 and older)

Affected: 1.2.0 and older
Fixed in: 1.2.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

NVD CVE-2026-102382 Patchstack advisory

medium 6.5 CVE-2026-13262 · published 2026-07-11

SQL injection in Majestic Support (1.1.9 and older)

Affected: 1.1.9 and older
Fixed in: 1.2.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.

NVD CVE-2026-13262 Wordfence advisory Plugin source

medium 5.4 CVE-2026-57646 · published 2026-06-26

Missing authorization check in Majestic Support (1.1.7 and older)

Affected: 1.1.7 and older
Fixed in: 1.1.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

NVD CVE-2026-57646 Patchstack advisory

medium 5.3 CVE-2026-40778 · published 2026-04-15

Missing authorization check in Majestic Support (1.1.2 and older)

Affected: 1.1.2 and older
Fixed in: 1.1.3
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.2.

NVD CVE-2026-40778 Patchstack advisory

high 7.5 CVE-2025-64284 · published 2025-10-29

File inclusion in Majestic Support (1.0.7 and older)

Affected: 1.0.7 and older
Fixed in: 1.0.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.7.

NVD CVE-2025-64284 Patchstack advisory

medium 5.3 CVE-2025-49860 · published 2025-09-09

Missing authorization check in Majestic Support (1.1.0 and older)

Affected: 1.1.0 and older
Fixed in: 1.1.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.

NVD CVE-2025-49860 Patchstack advisory

critical 9.3 CVE-2025-48283 · published 2025-05-23

SQL injection in Majestic Support (1.1.0 and older)

Affected: 1.1.0 and older
Fixed in: 1.1.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.

NVD CVE-2025-48283 Patchstack advisory

medium 5.3 CVE-2025-48282 · published 2025-05-19

Missing authorization check in Majestic Support (1.1.0 and older)

Affected: 1.1.0 and older
Fixed in: 1.1.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-48282 Patchstack advisory

high 8.1 CVE-2025-26985 · published 2025-02-25

File inclusion in Majestic Support (1.0.6 and older)

Affected: 1.0.6 and older
Fixed in: 1.0.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-26985 Patchstack advisory

high 7.5 CVE-2024-13600 · published 2025-02-12

Information disclosure in Majestic Support (1.0.5 and older)

Affected: 1.0.5 and older
Fixed in: 1.0.6 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets.

NVD CVE-2024-13600 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2024-13601 · published 2025-02-12

Missing authorization check in Majestic Support (1.0.5 and older)

Affected: 1.0.5 and older
Fixed in: 1.0.6 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export ticket data for any user.

NVD CVE-2024-13601 Wordfence advisory Code change (fix)Plugin source

Recent activity

2026-11-01 — latest release on wordpress.org (1.2.4).
2026-10-30 — SQL injection disclosed (CVE-2026-115820), fixed in 1.2.3.
2026-10-22 — Missing authorization check disclosed (CVE-2026-112218), fixed in 1.2.2.
2026-10-01 — Missing authorization check disclosed (CVE-2026-102381), fixed in 1.2.1.

Free. We check the CVE feeds every day and email you only when a new issue for Majestic Support (majestic-support) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (8) · SQL injection (3) · File inclusion (2) · Sensitive data exposure (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/majestic-support (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/majestic-support"><img src="https://laskyr.com/plugins/majestic-support/badge.svg" alt="Majestic Support vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Majestic Support safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (1.2.4)

What to do

Check your version

Known vulnerabilities

SQL injection in Majestic Support (1.2.2 and older)

Missing authorization check in Majestic Support (1.2.1 and older)

Missing authorization check in Majestic Support (1.2.0 and older)

Missing authorization check in Majestic Support (1.2.0 and older)

SQL injection in Majestic Support (1.1.9 and older)

Missing authorization check in Majestic Support (1.1.7 and older)

Missing authorization check in Majestic Support (1.1.2 and older)

File inclusion in Majestic Support (1.0.7 and older)

Missing authorization check in Majestic Support (1.1.0 and older)

SQL injection in Majestic Support (1.1.0 and older)

Missing authorization check in Majestic Support (1.1.0 and older)

File inclusion in Majestic Support (1.0.6 and older)

Information disclosure in Majestic Support (1.0.5 and older)

Missing authorization check in Majestic Support (1.0.5 and older)

Recent activity

Get an email when Majestic Support has a new vulnerability

Browse vulnerabilities

Where this data comes from