CVE-2023-49742CWE-862

WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability

Critical · published April 18, 2024

CVSS v3.1
9.9
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

🚨 A missing authorization check in Support Genix could let anyone access sensitive data without breaking a sweat! 🔥 Think of it like an open bank vault that anyone can stroll into; no ID required! Without proper checks, anyone could waltz away with private information as easily as grabbing snacks from a convenience store. An attacker could potentially gain unrestricted access to confidential support tickets, customer data, or system settings, leading to data breaches and loss of user trust. The implications could be absolutely devastating for any organization relying on this software.

Put simply

Think of it like an open bank vault that anyone can stroll into; no ID required! Without proper checks, anyone could waltz away with private information as easily as grabbing snacks from a convenience store. This vulnerability allows unauthorized users to bypass necessary authentication checks due to missing authorization mechanisms in Support Genix versions up to 1.2.3.

What to do

An attacker could potentially gain unrestricted access to confidential support tickets, customer data, or system settings, leading to data breaches and loss of user trust. The implications could be absolutely devastating for any organization relying on this software. Immediate action is crucial! Update Support Genix to version 1.2.4 or later to address this vulnerability. Additionally, review your access controls to ensure that sensitive information is adequately protected. You've got this! Implement these steps, and you'll be well on your way to securing your systems! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00762 · 54.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-04-18T08:11Z
EPSS history
Timeline
  • 18 APR 08:11Z
    WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability
    cvelistv5