Executive brief
Support Genix is a WordPress plugin used to manage customer support tickets. A security flaw in the plugin's file download feature allows unauthorized individuals to access files they shouldn't be able to see. While the flaw is limited to certain file types (like text files or images), it could allow an attacker to download private attachments from other users' support tickets or sensitive system files, potentially leading to a breach of customer privacy.
Technical details
A path traversal vulnerability exists in the Support Genix Lite plugin for WordPress due to insufficient validation of the file path in the ticket-attachment download REST API route (`/apbd-wps/v1/ticket/file-dl/`). An unauthenticated attacker can use double-encoded traversal sequences (e.g., `..%252F`) to escape the intended attachment directory. While the vulnerability is constrained by an extension allowlist (preventing the reading of `.php` files like `wp-config.php`), it allows for the unauthorized retrieval of any file with a permitted extension, such as `.txt` or image files, including private attachments belonging to other users. The issue is fixed in version 1.4.48.
Affected products
- HasThemes Support Genix Lite < 1.4.48
Timeline
- 2026-07-16: disclosed: Public disclosure by WPScan
- 2026-07-16: patched: Fixed version 1.4.48 released
- 2026-08-01: advisory: NVD published CVE-2026-15932