The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress versions up to 1.0.5 contains an Insecure Direct Object Reference vulnerability (CWE-639) in the 'exportusereraserequest' function. This occurs because the function does not validate a user-controlled key parameter, allowing authenticated users with Subscriber privileges or higher to bypass authorization controls and export ticket data of arbitrary users. The vulnerability is network exploitable with low attack complexity and no user interaction required. Confidentiality impact is limited to partial data disclosure; integrity and availability are not affected.

An authenticated attacker with Subscriber-level access or above can export ticket data for any user, potentially exposing sensitive support ticket information. The impact is limited to information disclosure (confidentiality) without affecting data integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual export activity related to the plugin. Avoid granting unnecessary privileges to users. Follow vendor updates closely for any forthcoming patches or official mitigations.