The vulnerability is an insecure direct object reference that permits an attacker to bypass authorization controls through user‑controlled keys. By manipulating identifiers in requests, an attacker can access or modify data belonging to other users, potentially exposing or altering sensitive information. The weakness is identified as CWE‑639, a classic authorization bypass scenario.

The plugin DevItems Support Genix (Support Genix‑Lite) is vulnerable in all released versions up to and including 1.4.11. The version information is listed as n/a through <= 1.4.11, meaning every build prior to 1.4.11 is affected. The plugin is installed on WordPress sites where the Support Genix functionality is enabled.

The CVSS score of 4.3 reflects a moderate severity, with a low exploitation probability reflected by an EPSS score of less than 1%. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely exploit this by crafting HTTP requests with altered object identifiers from a remote location. No known exploitation proof‑of‑concepts are reported, and the requirement for direct access to the WordPress admin interface reduces the likelihood of successful exploitation.