Information disclosure in ahmadmj Majestic Support – The Leading-Edge Help Desk &…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ahmadmj | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | up to 1.0.5 | — | No fix listed | CNA |
- Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin Vendorahmadmj Affected up to 1.0.5 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:majesticsupport:majestic_support:*:*:*:*:*:wordpress:*:* | before 1.0.6 | Vulnerable | Majestic Support |
- cpe:2.3:a:majesticsupport:majestic_support:*:*:*:*:*:wordpress:*:* Versions before 1.0.6 Vulnerable ·Majestic Support
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13600
- 2026-10-03 Alias added: GHSA-28ch-8r8v-jcg6
References
More ahmadmj vulnerabilities
- TI-2026-11259 Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter CVSS 3.1MEDIUM 6.5
- TI-2026-83245 SQL injection in Majestic Support WordPress plugin CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-13600 · CVE Program
- CVE-2024-13600 · NVD
- FIRST EPSS
- GHSA-28ch-8r8v-jcg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences