EUVD-2026-51724
GHSA-g8p2-p6hq-8pw4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, no authentication, no user interaction; confidentiality is low due to extension allowlist constraint; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension - including other users' private ticket attachments - from the server.
AnalysisAI
Directory traversal in Support Genix WordPress plugin before 1.4.48 exposes arbitrary server files to unauthenticated remote attackers via the ticket-attachment download route. Exploitation is constrained to files matching an allowlisted extension set, yet this still enables disclosure of other users' private ticket attachments and any other allowlisted-extension files accessible to the web server process. A publicly available proof-of-concept exists per WPScan, though EPSS sits at only 0.25% (17th percentile), indicating low observed exploitation pressure despite the low attack complexity.
Technical ContextAI
CWE-22 (Path Traversal) is the root cause: the plugin's ticket-attachment download route accepts a user-supplied filename or path parameter without adequately sanitizing directory traversal sequences (e.g., '../'). An incomplete mitigation - an allowlist of permitted file extensions - is the only guard, meaning the traversal is real but the attacker is limited to files whose names end in an allowed extension. The affected product is identified by CPE cpe:2.3:a:unknown:support_genix:*:*:*:*:*:*:*:* covering all versions below 1.4.48. As a WordPress plugin, Support Genix runs in the PHP process of the hosting web server, and the traversal radius is bounded by that process's filesystem read permissions - typically the web root and any world-readable paths above it.
RemediationAI
Vendor-released patch: Support Genix 1.4.48. Update the plugin immediately through the WordPress admin dashboard (Plugins → Updates) or manually replace plugin files with the 1.4.48 release. If immediate patching is not possible, a compensating control is to restrict web server access to the vulnerable download route - for example, adding a rewrite rule or WAF rule that blocks requests to the attachment download endpoint containing '../' or URL-encoded equivalents ('%2e%2e', '%2f'). Note that blocking solely on literal '../' is bypassable via encoding; a WAF rule must normalize the path before matching. Alternatively, temporarily deactivating the Support Genix plugin eliminates the attack surface at the cost of disabling support ticket functionality entirely.
More in Support Genix
View allSame weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today