Description

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T05:17:09.487Z",
  "pubdate": "2026-09-01T05:17:09.487Z",
  "executiveSummary": "The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is susceptible to an authentication bypass vulnerability that facilitates full administrative account takeover.\nThis vulnerability stems from a critical flaw in the plugin's encryption implementation, which utilizes a cryptographically weak key derivation process for its `guest_ticket_login()` function.\nBy exploiting the predictable entropy of the encryption key, an attacker with minimal (subscriber-level) privileges can perform offline brute-force attacks to derive the site-wide AES-256-CBC key.\nOnce the key is recovered, the attacker can forge authentication tokens for arbitrary users, including administrators. Upon submission of these forged tokens to the publicly accessible `/sgnix/?p=<token>` endpoint, the plugin triggers an unauthorized call to `wp_set_auth_cookie()`, granting the attacker complete administrative control over the affected WordPress installation.\nThis vulnerability poses an extreme risk as it circumvents standard WordPress authentication mechanisms, requiring no knowledge of actual user passwords, only the ability to craft valid-looking ticket tokens after successful key recovery.",
  "technicalDetails": "The root cause of this vulnerability is a flawed cryptographic implementation within the `guest_ticket_login()` function. The plugin derives its AES-256-CBC encryption key using a combination of three two-digit `wp_rand(10, 99)` integers and a Unix timestamp, which are subsequently processed via `md5()`. This mechanism yields a severely limited keyspace of approximately 19.5 bits of entropy (roughly 729,000 possible candidates).\nFurthermore, the encryption scheme employs a deterministic Initialization Vector (IV) derived directly from the password, lacks an authentication tag (making it susceptible to malleability), and operates without nonces, capability checks, or session validation on the `/sgnix/?p=<token>` endpoint.\nThe exploitation flow proceeds as follows: First, an attacker with subscriber-level access obtains a legitimate guest ticket token, which serves as a known-plaintext oracle. Second, by bounding the plugin's activation timestamp, the attacker constrains the potential search space for the `md5()`-hashed key components. Third, the attacker conducts an offline brute-force attack to exhaust the ~729,000-candidate keyspace, successfully recovering the static site-wide encryption key.\nWith the site-wide key in possession, the attacker can then perform cryptographic forgery. They construct a serialized object containing a target `ticket_id` and `ticket_user` (e.g., an administrator's user ID). This object is encrypted using the recovered key and the deterministic IV/encryption logic used by the plugin to generate the `p` parameter value.\nThe final stage of the attack involves appending the forged `p` token to the `/sgnix/?p=<token>` endpoint. When the server processes this request, the `guest_ticket_login()` function decrypts the malicious payload. Due to the lack of validation, the plugin accepts the forged credentials as legitimate, invokes `wp_set_auth_cookie()`, and logs the attacker into the WordPress site as the targeted administrator. This results in full system compromise, allowing for data exfiltration, malicious code execution, or site defacement."
}