Security readout for executives and security teams
Plain-English summary
A logged-in low-privilege WordPress user could export support ticket data belonging to other users in Majestic Support versions up to 1.0.5. The issue is limited to confidentiality based on the provided CVSS, but ticket contents may include sensitive customer or operational details.
Executive priority
Treat this as a moderate-priority privacy and customer-support data exposure issue. Prioritize sites with many customer tickets, public registration, or weak account hygiene. It is not described as remote code execution or active mass exploitation in the provided sources.
Technical view
CVE-2024-13601 is a CWE-639 IDOR in Majestic Support for WordPress. The exportusereraserequest function lacks validation for a user-controlled key, allowing authenticated Subscriber-level or higher attackers to export ticket data for any user. CVSS is 4.3 with low confidentiality impact only.
Likely exposure
Exposure is limited to WordPress sites running Majestic Support up to and including 1.0.5, where untrusted or compromised Subscriber-level accounts exist. Public reachability increases opportunity, but authentication is required.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires a logged-in Subscriber-level or higher account and targets unauthorized ticket-data export, not code execution or service disruption.
Researcher notes
The key evidence is Wordfence’s advisory, the vulnerable controller reference, and a WordPress plugin Trac changeset. The affected-version metadata in the bundle is inconsistent, so rely on the stated vulnerable range of up to and including 1.0.5 unless vendor guidance clarifies it.
Mitigation direction
- Inventory WordPress sites for Majestic Support versions up to 1.0.5.
- Update beyond 1.0.5 if vendor-approved fixed releases are available.
- Restrict or remove untrusted Subscriber-level accounts until remediation is complete.
- Disable the plugin if it is unused or cannot be promptly remediated.
- Review vendor and Wordfence guidance for confirmed fixed-version details.
Validation and detection
- Confirm whether Majestic Support is installed and record the exact plugin version.
- Check for Subscriber-level or higher accounts that are untrusted or dormant.
- Review access logs for unexpected exportusereraserequest activity.
- Verify remediated sites prevent users exporting other users' ticket data.
- Assess exposed ticket content for customer, credential, or regulated data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-13601 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf5537d-d80e-4844-8ed4-480f4a533439?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.0.5/modules/gdpr/controller.php#L110CVE reference
- https://plugins.trac.wordpress.org/changeset/3231938/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.