THREAT OPS › Threat News › [NVD] CVE-2026-15932 — The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the
[NVD] CVE-2026-15932 — The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the
CVE-2026-15932 CVSS: None Published: 2026-08-01T07:16:31.583
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
Indicators of compromise
- CVE-2026-15932cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15932