CVE-2026-14862

LowCVSS 3.7

Published: 31/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The Support Genix WordPress plugin before version 1.4.48 improperly authorizes access to support-ticket attachment downloads. Unauthenticated users who know the stored attachment file name can download other users' private ticket attachments.

Risk Assessment

Leakage of confidential support ticket attachments occurs, potentially violating user privacy and exposing sensitive data.

Recommendation

Update the Support Genix plugin to version 1.4.48 or later, which implements proper authorization for attachment access.

Original NVD description (English source)

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.