Executive brief
Support Genix is a WordPress plugin used to manage customer support tickets. A security flaw allows unauthorized individuals to download private files attached to support tickets if they know the specific, unique filename. This could lead to the exposure of sensitive customer information or private business documents shared during support interactions.
Technical details
The Support Genix Lite plugin for WordPress contains a missing authorization vulnerability in its REST API endpoint for file downloads (`/wp-json/apbd-wps/v1/ticket/file-dl/`). The vulnerability allows unauthenticated users to bypass access controls and download ticket or reply attachments. However, exploitation is difficult because the plugin prepends a 32-character cryptographically secure random MD5 prefix to filenames stored on disk. An attacker must obtain the exact, full filename (including the prefix) through out-of-band means, such as a leaked link or referrer header, to successfully retrieve the file. The issue is resolved in version 1.4.48.
Affected products
- HasThemes Support Genix Lite < 1.4.48
Timeline
- 2026-07-16: disclosed
- 2026-07-31: advisory: NVD publication date