Update Support Genix to 1.4.55 for CVE-2026-110895
October 19, 2026
CVE-2026-110895 affects Support Genix through version 1.4.54. The repair floor is 1.4.55. The reported issue is SQL injection, and exploitation is not established. Support Genix is a specific helpdesk product; this does not apply to every WordPress helpdesk plugin.
Establish a safe maintenance baseline
Confirm that the installed plugin is Support Genix, then record its version, activation state, WordPress and PHP versions, user roles that can access helpdesk functions, integrations, and any custom ticket templates. This avoids applying a product-specific advisory to an unrelated support system.
Back up the database and plugin files using the site’s established process. A staging copy should contain synthetic tickets, fictional contacts, and non-sensitive attachments. Note the recovery owner and restoration procedure before updating, since a backup is useful only if it can be restored safely and within the organization’s recovery limits.
- Affected range: through 1.4.54.
- Fixed floor: 1.4.55.
- Reported condition: SQL injection.
- Reported exploitation: not established.
Move to the repair floor
Update Support Genix through the normal WordPress plugin maintenance path to 1.4.55 or a later compatible version. Review the plugin’s stated compatibility requirements before production deployment, especially where the helpdesk connects to email, automation, or customer-data services.
After the update, verify that Support Genix is active and its version is at least 1.4.55. If an operational issue requires a temporary restore, document that the restored version may fall back into the affected range. Address the compatibility issue promptly rather than treating rollback as a completed remediation.
Validate normal helpdesk work
On staging, use a fictional requester to create a test ticket, assign it to an authorized synthetic agent, add an ordinary reply, change its normal status, and confirm expected notifications or mailbox routing. Verify that attachments and customer-facing displays behave as expected when those functions are enabled. Keep the test data plainly non-production.
Review application and server logs for update-related warnings, failed jobs, or integration errors. Capture the test ticket identifiers, expected versus actual results, and version evidence. Do not use security probes or attempt to reproduce the reported issue; functional validation is sufficient for this maintenance workflow.
Look back using available records
The advisory does not establish active exploitation. Review available role changes, agent-account activity, ticket access patterns, configuration edits, database errors, and hosting alerts for unexplained anomalies during the relevant period. The review should be evidence-led and proportionate to the site’s retention and privacy rules.
Escalate credible anomalies through the incident process and preserve logs before rotation where possible. Updating reduces the reported software risk but cannot certify the historical integrity of tickets or accounts.
