Executive brief
Support Genix is a WordPress plugin providing helpdesk and ticketing functionality for customer support. A weak encryption implementation allows authenticated users with subscriber access to forge admin authentication tokens and gain full administrative control of the affected WordPress site, bypassing all login security.
Technical details
The vulnerability is an authentication bypass in the `guest_ticket_login()` function, accessible via the `/sgnix/?p=` endpoint without proper nonce, session, or capability validation. The root cause is a severely weak encryption key derivation using only ~19.5 bits of entropy (three random two-digit values and a timestamp hashed with MD5), combined with a deterministic IV derived from the password and no authentication tag on the ciphertext. An authenticated subscriber-level attacker can obtain a legitimate guest ticket token as a known-plaintext oracle, bound the plugin activation timestamp, and exhaust the ~729,000 candidate keyspace entirely offline to recover the site-wide AES-256-CBC encryption key. Once recovered, the attacker can forge a valid token targeting an administrator-owned ticket, which when submitted causes `wp_set_auth_cookie()` to grant full admin privileges. No patch information is currently available.
Affected products
- Support Genix Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System 1.4.52 and earlier
Timeline
- 2026-09-01: disclosed