CVE-2026-15932 — Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitr…
Published: 2026-08-01 · CVSS: 5.3 · CVSS 3.1
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7