CVE-2026-15932 is a path traversal vulnerability in the Support Genix WordPress plugin prior to version 1.4.48. The plugin fails to properly restrict pathname inputs in its ticket-attachment download functionality, enabling unauthenticated attackers to access arbitrary files with allowlisted extensions on the server. This can lead to unauthorized disclosure of private ticket attachments and other sensitive files accessible via the vulnerable route. The vulnerability has a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker can read arbitrary files with allowed extensions on the server without authentication, potentially exposing private ticket attachments of other users. There is no impact on integrity or availability reported. The confidentiality impact is limited but could expose sensitive user data stored as attachments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected plugin functionality or disable the plugin if possible to mitigate risk.