CVE-2025-49860

Executive Summary

CVE-2025-49860 is a Missing Authorization vulnerability in the Majestic Support WordPress plugin, affecting versions from n/a through 1.1.0. This flaw allows unauthenticated attackers to bypass authorization checks, potentially accessing or modifying support-related data without proper credentials. The vulnerability has a CVSS score of 5.3 (Medium), with a low EPSS score of 0.0% indicating limited active exploitation at this time. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for official updates. Since no patch is available, consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score suggests limited exploitation, but the lack of a patch increases risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability resides in the Majestic Support plugin’s authorization logic. The plugin likely fails to enforce proper capability checks on AJAX actions or REST API endpoints, allowing unauthenticated users to perform actions intended for authenticated support staff. This could include viewing, creating, or modifying support tickets, messages, or settings.

The missing authorization check is a classic CWE-862 issue, where the plugin does not verify the user’s permissions before executing sensitive operations. Attackers can craft HTTP requests to trigger these actions without a valid session or nonce.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. A typical vulnerable snippet might look like:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_majestic_create_ticket', 'majestic_create_ticket');
function majestic_create_ticket() {
    // Process ticket creation without checking user permissions
    $ticket_data = $_POST['ticket'];
    // ... save to database
}

A patched version would include a capability check:

// Patched: Check user capability
add_action('wp_ajax_majestic_create_ticket', 'majestic_create_ticket');
function majestic_create_ticket() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Process ticket creation
    $ticket_data = $_POST['ticket'];
    // ... save to database
}

The key difference is the removal of wp_ajax_nopriv_ (which allows unauthenticated access) and the addition of current_user_can() checks.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with Majestic Support plugin version 1.1.0 on a local server.
2. Recon: Identify AJAX actions or REST endpoints used by the plugin. Use browser developer tools or intercept proxy (Burp Suite) to capture requests.
3. Exploit: Send a crafted HTTP request to the vulnerable endpoint without authentication. For example:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=majestic_create_ticket&ticket[subject]=Test&ticket[message]=Exploit
   

4. Verify: Check if the ticket is created in the database without a valid session.

Blue Team

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with action parameters related to Majestic Support from unauthenticated users.
2. Logging: Enable WordPress debug logging (WP_DEBUG_LOG) to capture suspicious activity.
3. Mitigation: Temporarily disable the plugin or implement a web application firewall (WAF) rule to block unauthenticated access to known vulnerable endpoints.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=majestic_* parameters from unauthenticated sources.
• File: Unexpected creation of support tickets or messages in the database without corresponding user sessions.
• Log: WordPress debug log entries showing wp_ajax_nopriv_majestic_* actions being triggered.

Detection Engineering

YARA Rule

rule CVE_2025_49860_Majestic_Support_Missing_Auth {
    meta:
        description = "Detects exploitation attempts for CVE-2025-49860 in Majestic Support plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49860"
    strings:
        $ajax_action = "majestic_" nocase
        $admin_ajax = "admin-ajax.php" nocase
        $nopriv = "wp_ajax_nopriv" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-49860 Majestic Support Missing Authorization
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to Majestic Support plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=majestic_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin functionality if misconfigured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49860 Majestic Support Missing Authorization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=majestic_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Majestic Support plugin until an official patch is released.
2. Workaround: Implement a web application firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action parameters starting with majestic_.
3. Long-term: Monitor the plugin’s official repository for updates. Apply the patch as soon as it becomes available.
4. Hardening: Ensure WordPress is updated to the latest version and follow least-privilege principles for user roles.

Valters IT
Securing Digital Frontiers