CVE-2026-14862 in Support Genix Plugin

الملخص

بحسب MITRE • 31/07/2026

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• مسؤول: WPScan
• حجز: 06/07/2026
• إفشاء: 31/07/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-385032
• CPE: جاهز
• CWE: CWE-862 (مؤكد)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: لا
• النشاطات: منخفض
• القطاع: Hostingprovider

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-14862
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14862
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-14862/