{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adevitemssupport_genixwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:devitems:support_genix:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-110895"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Support Genix (\u003c= 1.4.54)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["DevItems"],"content_html":"\u003cp\u003eThe Support Genix plugin for WordPress is affected by an SQL injection vulnerability, identified as CVE-2026-110895, due to the improper neutralization of special elements within SQL commands. This flaw exists in all versions of the Support Genix Lite plugin up to and including 1.4.54. The vulnerability is highly critical as it allows both authenticated and unauthenticated attackers to manipulate the plugin's database interactions. By injecting malicious SQL payloads, an adversary can bypass security controls to exfiltrate sensitive site data, modify database records, or potentially gain further control over the WordPress application environment. This vulnerability highlights the ongoing risk of insecure input handling in third-party WordPress plugins and mandates immediate remediation for any organization utilizing this software.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability enables attackers to perform unauthorized database operations on the affected WordPress site. This can lead to the complete compromise of data stored within the application, including user information, internal site configuration, and sensitive business records. If the database user has elevated privileges, the impact could potentially extend to full site compromise or lateral movement within the hosting infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately identify and audit all WordPress installations for the presence of the Support Genix plugin.\u003c/li\u003e\n\u003cli\u003eDisable or uninstall the Support Genix plugin if an update to a version beyond 1.4.54 is not yet available or verified by the vendor.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious POST or GET requests targeting the Support Genix plugin endpoints that contain SQL keywords (e.g., UNION, SELECT, OR 1=1) or common SQL injection syntax.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to block requests containing common SQL injection patterns targeting WordPress plugin parameters.\u003c/li\u003e\n\u003cli\u003ePerform a security scan of the database for unauthorized user accounts or anomalous data changes following the discovery of this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T11:57:59Z","date_published":"2026-10-18T11:57:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sql-injection-support-genix/","summary":"An SQL injection vulnerability in the Support Genix WordPress plugin allows remote attackers to execute arbitrary database queries, potentially leading to full unauthorized data access or modification.","title":"SQL Injection Vulnerability in Support Genix WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-sql-injection-support-genix/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:devitems:support_genix:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}