CVE-2026-19806

Support Genix, a WordPress helpdesk/ticketing plugin, is vulnerable to an authentication bypass that enables full administrator account takeover in all versions through 1.4.52. The site-wide AES-256-CBC key used to encrypt guest ticket login tokens is derived from only about 19.5 bits of entropy (three two-digit random values and a Unix timestamp hashed with md5()), with a deterministic IV, no integrity tag, and no capability check, nonce, or session validation on the publicly reachable /sgnix/?p= endpoint. An attacker with at least subscriber-level access who obtains one legitimate guest ticket token as a known-plaintext oracle and can bound the plugin's activation timestamp can exhaust the ~729,000-candidate keyspace offline, recover the site-wide encryption key, and forge a token for any administrator-owned ticket; submitting it triggers wp_set_auth_cookie() and logs the attacker in as that administrator with full site control. All WordPress sites running Support Genix 1.4.52 or earlier are affected, though exploitation requires subscriber-level access and the guest ticket login feature. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Update Support Genix to a release newer than 1.4.52 as soon as a patched version is available (no fixed version number is confirmed in the available data). Until patching, disable the guest ticket login/access feature or restrict external access to the /sgnix/ endpoint, and audit recent administrator logins for signs of forged guest-token sessions, resetting admin credentials if compromise is suspected.