What is the CVSS score of CVE-2026-14862?

CVE-2026-14862 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14862?

Yes, a public proof-of-concept exploit is available for CVE-2026-14862. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14862?

Yes, a patch is available for CVE-2026-14862. Update the affected software to the latest version immediately.

Support Genix CVE-2026-14862

EUVD-2026-51439 LOW

Missing Authorization (CWE-862)

2026-07-31 WPScan

GHSA-h486-m22j-4m8r

WordPress Authentication Bypass Support Genix Unknown

3.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

AV:N because exploitation is a direct web request; AC:H because the attacker must independently obtain the attachment filename; PR:N since no login is needed; C:L as only attachment files are disclosed, not credentials or full database.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:24 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

3.7 (LOW)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

LOW 3.7

DescriptionCVE.org

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.

AnalysisAI

Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.

Technical ContextAI

Support Genix is a WordPress plugin providing a customer support ticketing system, allowing users to submit tickets and upload file attachments. The vulnerability stems from CWE-862 (Missing Authorization): the plugin's attachment download handler does not verify whether the requesting party owns or is otherwise permitted to access the requested ticket attachment. WordPress plugins are expected to enforce capability checks (e.g., current_user_can()) or nonce validation before serving private user data; this plugin omits both for the download route. The affected scope is any deployment running the plugin at versions below 1.4.48, per CPE cpe:2.3:a:unknown:support_genix:*:*:*:*:*:*:*:*.

RemediationAI

Update the Support Genix plugin to version 1.4.48 or later - this is the vendor-released patch confirmed via WPScan advisory (https://wpscan.com/vulnerability/ef1c6fd5-e62c-4951-a0ba-0e61edb1e795/). The update can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Support Genix > Update. If immediate patching is not feasible, a targeted compensating control is to restrict access to the plugin's attachment download URL path (identifiable from the plugin source) at the web server or WAF layer, allowing only authenticated session cookies - trade-off: this may break legitimate attachment access for logged-in ticket owners and require configuration tuning. Disabling the file attachment feature in plugin settings is a more disruptive but effective temporary control if attachment functionality is not business-critical. Audit access logs for the attachment download endpoint to detect any prior unauthorized access to sensitive files.