CVE-2026-15932: Support Genix Path Traversal Flaw

CVE-2026-15932 Overview

CVE-2026-15932 is a directory traversal vulnerability in the Support Genix WordPress plugin before version 1.4.48. The flaw resides in the plugin's ticket-attachment download route, which fails to sanitize user-supplied path input. Unauthenticated attackers can traverse the filesystem and read arbitrary files that carry an allowlisted extension. This includes other users' private ticket attachments stored on the server. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated attackers can read arbitrary files with allowlisted extensions from the WordPress host, exposing private support ticket attachments and other sensitive server-side content.

Affected Products

Support Genix WordPress plugin versions prior to 1.4.48
WordPress sites exposing the ticket-attachment download route
Multi-tenant WordPress deployments hosting Support Genix tickets

Discovery Timeline

2026-08-01 - CVE-2026-15932 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15932

Vulnerability Analysis

Support Genix implements a download handler that serves ticket attachments to authorized requesters. The handler accepts a filename or path parameter and returns the referenced file. Before version 1.4.48, the handler does not normalize the path or reject traversal sequences such as ../. It also does not verify that the resolved file resides within the intended attachment directory or that the caller owns the ticket.

Because the endpoint is reachable without authentication, any remote user can invoke it. The handler still enforces an extension allowlist, which limits confidentiality impact to files ending in permitted extensions. Attackers can enumerate and exfiltrate other tenants' ticket attachments, WordPress configuration fragments, or exported logs that match the allowlist.

Root Cause

The root cause is missing path canonicalization and missing ownership checks on the attachment download route. User-supplied path components are concatenated into a filesystem path and passed to a file read routine without validating that the resolved path stays inside the attachment storage directory or belongs to the requesting user.

Attack Vector

Exploitation requires only a single HTTP request to the vulnerable download endpoint. The attacker supplies a traversal payload in the file parameter that references a target outside the attachment directory. No authentication, user interaction, or elevated privileges are required. See the WPScan Vulnerability Details for technical specifics.

Detection Methods for CVE-2026-15932

Indicators of Compromise

Requests to the Support Genix attachment download route containing ../ or URL-encoded traversal sequences such as %2e%2e%2f.
Unauthenticated access patterns retrieving attachments belonging to multiple, unrelated ticket IDs from a single client IP.
Web server access logs showing successful 200 responses to attachment downloads for filenames that do not exist in the plugin's upload directory.

Detection Strategies

Inspect HTTP request logs for traversal payloads targeting Support Genix endpoints and correlate with response codes and byte counts.
Flag any request to the plugin's download route that lacks a valid authenticated session cookie or nonce.
Compare downloaded filenames against the plugin's known attachment directory listing to identify out-of-scope reads.

Monitoring Recommendations

Enable WordPress and web application firewall (WAF) logging for all Support Genix plugin routes.
Alert on bursts of attachment download requests from a single source within short time windows.
Monitor for reads of sensitive files such as wp-config.php backups or exported .log files that share allowlisted extensions.

How to Mitigate CVE-2026-15932

Immediate Actions Required

Update the Support Genix plugin to version 1.4.48 or later on all WordPress instances.
Audit web server and plugin logs for prior exploitation attempts targeting the attachment download route.
Rotate any credentials or secrets that may have been present in files matching the allowlisted extensions.

Patch Information

The vendor addressed the vulnerability in Support Genix 1.4.48 by adding path validation and ownership checks on the ticket-attachment download route. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan advisory for the confirmed fixed version.

Workarounds

Deactivate the Support Genix plugin until the patched version can be installed.
Deploy a WAF rule that blocks traversal sequences (../, ..\, %2e%2e%2f) on Support Genix download routes.
Restrict access to the plugin's endpoints using web server rules that require authenticated sessions.

bash

# Example nginx rule to block traversal sequences on Support Genix routes
location ~* /wp-content/plugins/support-genix/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
}