CVE-2026-15932 — Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal

CVE-2026-15932

Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal PUBLISHED

Description (CNA)

The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.

Affected (CNA)

Vendor / product	Versions
Unknown / Support Genix	affected 0 before 1.4.48

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d03887a5-1a0e-4097-8dfa-7899aae8a6d5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.