The Support Genix WordPress plugin allows an attacker to read arbitrary files on the server through a directory traversal vulnerability in its ticket‑attachment download route. The flaw lets unauthenticated users request files that have an allowed extension, including private ticket attachments belonging to other users, thereby exposing sensitive data. The weakness is a classic path traversal flaw (CWE‑22).

Any installation of the Support Genix plugin running a version earlier than 1.4.48 is vulnerable. The issue to all WordPress sites that host this plugin and have the ticket‑attachment download route enabled, regardless of the hosting environment or WordPress configuration.

The EPSS score is below 1 % and the CVSS base score is 5.3, the vulnerability is not listed in CISA KEV, indicating a low to moderate likelihood of exploitation. Nonetheless, the impact is high because the flaw permits the disclosure of confidential user data without any authentication requirement. An attacker would target the /ticket‑attachment download endpoint, supply a crafted filename that traverses directories (e.g., ../../../../etc/passwd) and receive the contents of the requested file. Although the attack is single‑point and web‑based, it can lead to significant privacy breaches.