Support Genix CVE-2026-110895

Exploitation requires an authenticated session on a WordPress site that has the Support Genix (support-genix-lite) plugin installed and active at version 1.4.54 or earlier; the CVSS PR:L metric indicates a low-privilege account (such as a subscriber or similar authenticated role) is sufficient, but a completely unauthenticated attacker is not indicated by the vector. The limiting factors are therefore: (1) the plugin must be installed and active, and (2) the attacker must possess or obtain valid low-privilege credentials. No special non-default configuration is called out in the description. The exact vulnerable parameter/endpoint is not specified in the provided data and should be confirmed from the Patchstack advisory.

This is a CWE-89 SQL Injection in the WordPress plugin Support Genix (support-genix-lite) by DevItems, affecting all versions up to and including 1.4.54. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates network-reachable, low-complexity exploitation that nonetheless requires some level of authentication (PR:L) - consistent with Patchstack's typical finding that a low-privilege WordPress user (e.g. subscriber/author) can trigger the injection. Exploitation status is: no public exploit identified at time of analysis (no KEV listing and no POC flag in the input). No EPSS score was provided, and no SSVC decision data was supplied, so probabilistic and decision-framework signals are entirely absent and cannot be weighed. The net picture is a genuinely serious database-confidentiality bug (C:H) that is realistic to exploit once an attacker holds any low-privilege account, but there is currently NO evidence of active exploitation or available weaponization, which lowers immediate urgency relative to the 8.5 score. One internal inconsistency worth flagging: the vector asserts S:C (scope change) and A:L yet I:N, which is unusual for SQL injection - SQLi commonly yields integrity impact (data modification) rather than availability impact, so the exact impact profile should be verified against the vendor/Patchstack advisory. Overall: a high-severity, patch-worthy issue for sites running this plugin, but not a drop-everything emergency absent exploitation signals.

An attacker who holds a low-privilege authenticated account on a WordPress site running Support Genix (≤1.4.54) submits a crafted request to a vulnerable plugin endpoint, injecting SQL into an insufficiently sanitized parameter. The injection lets the attacker read sensitive data from the WordPress database, such as user records and password hashes. No public proof-of-concept is identified at time of analysis, so exploitation would require the attacker to develop the injection independently.