Unauthenticated File Download in Support Genix WordPress Plugin

Executive Summary

The Support Genix WordPress plugin before version 1.4.48 has a flaw where it does not properly restrict access to support ticket attachments. Unauthenticated users can download private ticket attachments if they know the stored filename, which follows a predictable pattern. The exploit requires the exact filename, as using the original name alone does not work.

Useful 0 Not Useful 0

Detection Guidance

Check for outdated Support Genix plugin versions below 1.4.48 by inspecting WordPress installations. Look for predictable attachment paths like wp-content/uploads/support-genix/{ticket_id}/attached_files/{md5}___{original-name} in server logs or file structures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access private ticket attachments, potentially exposing sensitive information. However, exploitation is limited because attackers need the exact stored filename, which may require obtaining it through other means like leaked links.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to unauthorized access to private ticket attachments. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to attachments containing such data could violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Support Genix plugin to version 1.4.48 or later immediately. Review server logs for suspicious attachment download attempts and restrict access to sensitive ticket files.

Useful 0 Not Useful 0