CVE-2026-15932
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Support Genix WordPress plugin before version 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension, including other users' private ticket attachments.
Risk Assessment
An attacker can access confidential files such as other users' ticket attachments, potentially leading to leakage of personal data or business information. The vulnerability does not require authentication.
Recommendation
Immediately update the Support Genix plugin to version 1.4.48 or later, which fixes this vulnerability. Also restrict file access to authenticated users only.
Other vulnerabilities in Support Genix
See all- CVE-2026-110895High
The Support Genix plugin (up to version 1.4.54) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.
- CVE-2026-19806High
The Support Genix plugin for WordPress up to version 1.4.52 is vulnerable to authentication bypass leading to administrator account takeover via the guest_ticket_login() function and its p parameter. The site-wide AES-256-CBC encryption key is derived from only three two-digit wp_rand(10, 99) values and a Unix timestamp via md5(), yielding approximately 19.5 bits of entropy, combined with a deterministic IV. This allows authenticated attackers with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle, to recover the encryption key and forge a token for an administrator, leading to full administrative access.
Original NVD description (English source)
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS