The Support Genix plugin for WordPress does not properly neutralize special characters in user supplied input that is passed to the database, allowing a malicious actor to inject arbitrary SQL commands. This flaw, classified as CWE‑89, can lead to unauthorized data extraction, modification, or deletion within the WordPress database and could enable further exploitation depending on the privileges of the database user.

Any WordPress installation running the DevItems Support Genix plugin version 1.4.54 or older is affected. The plugin is available under the DevItems brand and is commonly deployed in WordPress support ticket systems.

The CVSS score of 8.5 indicates high severity. Although the EPSS score is not available, the absence of a KEV listing does not diminish the risk, as the vulnerability can be triggered remotely via the plugin’s exposed interfaces. An attacker who can send crafted requests to the plugin could exploit the flaw to retrieve or alter data stored in the site's database, potentially compromising sensitive user information and site integrity.