Support Genix attachment names can unlock private ticket files
Support Genix before 1.4.48 does not adequately authorize support-ticket attachment downloads. An unauthenticated visitor who obtains a stored attachment filename can request and download another user's private ticket attachment. The published record does not identify how a filename is obtained, the download route or parameter, or the file-serving callback, so filename disclosure remains a separate prerequisite and the exact request mechanics are unknown.
- Component
- Support Genix
- Plugin slug
support-genix- Affected
- < 1.4.48
- Safe version
1.4.48- Published
- Jul 31, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 31, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Support Genix to 1.4.48 or later. Review download logs for unauthenticated requests to ticket attachments, determine which filenames and files may have been exposed, and handle sensitive attachment content according to the site's privacy and incident-response obligations.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N