The Support Genix Lite WordPress plugin contains a flaw that fails to enforce proper authorization checks when downloading support‑ticket attachments. Because the plugin does not verify that the requester owns the ticket, unauthenticated users who know or can guess the stored filename can retrieve other users' private attached files. The flaw permits disclosure of confidential information that should remain private and represents a missing Authorization weakness and an Access Control weakness (CWE‑862).

The vulnerability affects all installations of the Support Genix Lite WordPress plugin with a version lower than 1.4.48. Any WordPress site using 1.4.47 or earlier releases is at risk, particularly when it stores private support tickets as attachment files.

Over the web, the attack requires no authentication; the attacker only needs to supply the target file name to the download endpoint. The likely attack vector is directly invoking the download URL – this is inferred from the description. While the EPSS score of < 1% indicates a low probability of exploitation, the CVSS score of 3.7 shows the flaw is moderate‑severity. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time. Nonetheless, the simplicity of the exploit path warrants verification of patch status.