Description
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.
Published: 2026-09-01
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Administrator Account Takeover
Action: Immediate Patch
AI Analysis

Impact

The Support Genix plugin for WordPress allows an authenticated subscriber or higher to bypass authentication and take over an administrator account by forging a guest ticket token; the flaw resides in the guest_ticket_login() function, which accepts a public p parameter on the /sgnix/?p endpoint, and relies on a site-wide AES‑256‑CBC key derived from low-entropy values and a deterministic IV, enabling an offline brute-force of the ~729,000-candidate keyspace once a single valid token is obtained.

Affected Systems

This vulnerability affects the Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress. All released versions up to and including 1.4.52 are impacted; versions beyond 1.4.52 are presumed to contain the fix.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high‑severity risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog; an attacker only needs a subscriber‑level account to obtain a guest ticket, after which the low‑entropy key can be recovered offline, allowing the forging of an administrator‑level ticket that triggers wp_set_auth_cookie() at the unprotected /sgnix/?p endpoint, thus granting full administrative access.

Generated by OpenCVE AI on September 1, 2026 at 06:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Support Genix plugin to the latest available version, which implements proper key derivation and access checks.
  • If an upgrade cannot be performed immediately, disable or uninstall the plugin entirely, or configure the web server to block the /sgnix/?p endpoint for all authenticated users except administrators.
  • Apply general WordPress hardening: enforce HTTPS sitewide, keep the core, plugins, and themes updated, and review user roles to limit the number of subscriber‑level accounts with access to the admin area.

Generated by OpenCVE AI on September 1, 2026 at 06:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Devitemsllc
Devitemsllc support Genix – Helpdesk, Ai Chatbot, Knowledge Base & Customer Support Ticketing System
Wordpress
Wordpress wordpress
Vendors & Products Devitemsllc
Devitemsllc support Genix – Helpdesk, Ai Chatbot, Knowledge Base & Customer Support Ticketing System
Wordpress
Wordpress wordpress

Tue, 01 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Description The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.
Title Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Devitemsllc Support Genix – Helpdesk, Ai Chatbot, Knowledge Base & Customer Support Ticketing System
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-02T17:53:01.887Z

Reserved: 2026-08-13T21:00:07.082Z

Link: CVE-2026-19806

cve-icon Vulnrichment

Updated: 2026-09-02T17:52:57.798Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T05:17:09.487

Modified: 2026-09-02T18:19:16.490

Link: CVE-2026-19806

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:15:41Z

Weaknesses