Quick answers
- Is CVE-2026-14862 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14862 being exploited in the wild.
- How severe is CVE-2026-14862?
- Informational severity, with a CVSS score of 3.7, published 31 July 2026.
- Which products and versions are affected?
- HasThemes Support Genix Lite < 1.4.48.
- Is there a fix for CVE-2026-14862?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14862 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14862?
- Check whether you run HasThemes Support Genix Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Support Genix Lite plugin for WordPress contains a missing authorization vulnerability in its REST API endpoint for file downloads (`/wp-json/apbd-wps/v1/ticket/file-dl/`). The vulnerability allows unauthenticated users to bypass access controls and download ticket or reply attachments. However, exploitation is difficult because the plugin prepends a 32-character cryptographically secure random MD5 prefix to filenames stored on disk. An attacker must obtain the exact, full filename (including the prefix) through out-of-band means, such as a leaked link or referrer header, to successfully retrieve the file. The issue is resolved in version 1.4.48.
Affected products
- HasThemes Support Genix Lite < 1.4.48
Timeline
- 2026-07-16: disclosed
- 2026-07-31: advisory: NVD publication date