CVE-2026-15932: Support Genix WordPress plugin directory traversal in ticket-attachment download

CVE-2026-15932 · Severity: info · CVSS 5.3 · Published 2026-08-01

Support Genix is a WordPress plugin used to manage customer support tickets. A security flaw in the plugin's file download feature allows unauthorized individuals to access files they shouldn't be able to see. While the flaw is limited to certain file types (like text files or images), it could allow an attacker to download private attachments from other users' support tickets or sensitive system files, potentially leading to a breach of customer privacy.

Vendors: HasThemes.

Quick answers

Is CVE-2026-15932 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15932 being exploited in the wild.
How severe is CVE-2026-15932?
Informational severity, with a CVSS score of 5.3, published 1 August 2026.
Which products and versions are affected?
HasThemes Support Genix Lite < 1.4.48.
Is there a fix for CVE-2026-15932?
A patch was published on 2026-07-16: Fixed version 1.4.48 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15932 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15932?
Check whether you run HasThemes Support Genix Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Support Genix Lite plugin for WordPress due to insufficient validation of the file path in the ticket-attachment download REST API route (`/apbd-wps/v1/ticket/file-dl/`). An unauthenticated attacker can use double-encoded traversal sequences (e.g., `..%252F`) to escape the intended attachment directory. While the vulnerability is constrained by an extension allowlist (preventing the reading of `.php` files like `wp-config.php`), it allows for the unauthorized retrieval of any file with a permitted extension, such as `.txt` or image files, including private attachments belonging to other users. The issue is fixed in version 1.4.48.

Affected products

  • HasThemes Support Genix Lite < 1.4.48

Timeline

  • 2026-07-16: disclosed: Public disclosure by WPScan
  • 2026-07-16: patched: Fixed version 1.4.48 released
  • 2026-08-01: advisory: NVD published CVE-2026-15932

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.