EUVD-2026-68969
GHSA-28p5-rf4f-5qq9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level WordPress account
-
DeliverySubmit ticket to capture guest token (known-plaintext oracle)
-
ExploitExhaust ~729k keyspace offline to recover site-wide AES key
-
ExecutionForge admin-targeting authentication token
-
PersistSubmit token to public /sgnix/?p= endpoint
-
Impactwp_set_auth_cookie() grants full administrator access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold a subscriber-level (or higher) WordPress account on the target site - requiring either open user registration or a pre-existing credential. They must obtain at least one legitimate guest ticket token to serve as a known-plaintext oracle for offline key recovery; a subscriber can self-generate this by submitting a support ticket. The attacker must also bound the plugin's activation timestamp to constrain the brute-force window, achievable via Wayback Machine metadata or site activity indicators. At least one administrator-owned support ticket must exist in the system for the forged token to target. Exploitation is limited by: the need for a valid subscriber account (sites with registration disabled significantly reduce exposure); the requirement to identify an administrator-owned ticket ID (may require enumeration); and the |
| Impact | The Wordfence-assigned CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: the attack is network-accessible, requires only subscriber-level access, involves no user interaction, and yields full CIA impact through admin takeover. The AC:L rating is well-justified because 729,000 AES key candidates can be exhausted in under a second on commodity hardware, and subscriber accounts - the lowest registered user tier in WordPress - are trivially obtainable on sites with open registration. No EPSS score was available in the provided intelligence, and this CVE is not currently listed in CISA KEV, leaving exploitation probability unquantified; no public exploit code has been identified at time of analysis. Despite the absence of confirmed in-the-wild exploitation, the cryptographic weaknesses are clearly described and technically straightforward to weaponize, meaning even a mid-sized municipal IT team in walbrzych running this plugin with open subscriber registration should treat this as urgent. The primary real-world risk limiters are whether the site permits subscriber registration and whether an administrator-owned ticket exists for targeting - sites with registration disabled or no active ticketing workflow face substantially reduced exposure. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on the target WordPress site, submits a support ticket to obtain a legitimate guest ticket token, and uses it as a known-plaintext oracle to bound the brute-force search. They exhaustively test all ~729,000 AES key candidates offline - completable in under a second on modern hardware - recover the site-wide encryption key, and craft a forged token referencing an administrator-owned ticket ID. Submitting the forged token to the unguarded |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The guest_ticket_login() function at the publicly reachable /sgnix/?p=<token> endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.
RemediationAI
A fix has been committed to the WordPress plugin repository (changeset 3668350 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3668350%40support-genix-lite&new=3668350%40support-genix-lite); however, an exact patched release version number is not independently confirmed from available data - consult the Wordfence advisory and the WordPress plugin directory for the latest release before updating. Until a verified patched version is installed, administrators should disable open subscriber registration to remove the low-privilege account prerequisite, disable guest ticket login functionality if operationally tolerable (note this will break legitimate guest ticket workflows), and restrict access to the /sgnix/ endpoint via WAF rules or server-level rewrite controls. Authentication logs should be monitored for unexpected admin-level logins. Blocking /sgnix/ is the highest-impact compensating control but carries a functional trade-off for sites relying on guest ticket access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the Apbd_Wps_EncryptionLib encryption library within the Support Genix plugin (CPE: cpe:2.3:a:devitemsllc:support_genix_-_helpdesk,_ai_chatbot,_knowledge_base_&_customer_support_ticketing_system:*:*:*:*:*:*:*:*). The root cause maps to CWE-287 (Improper Authentication) and stems from several compounding cryptographic failures visible in the plugin's trac source: the site-wide AES-256-CBC key is derived by feeding three wp_rand(10,99) outputs (each 2-digit) and a Unix timestamp into md5(), collapsing the effective entropy to roughly 19.5 bits and producing a keyspace of only ~729,000 candidates. The encryption IV is derived deterministically from the password/token content rather than being randomly generated per encryption, eliminating the confidentiality guarantee IVs are meant to provide. No authentication tag (HMAC or AEAD) is applied to the ciphertext, meaning forgeries cannot be detected. The public endpoint /sgnix/?p=<token> performs no WordPress capability check, nonce verification, or session validation, so a valid-looking forged token directly triggers wp_set_auth_cookie() for whichever user is referenced in the token payload.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable public endpoint; subscriber access sufficient; ~729k keyspace trivially exhausted offline; full admin takeover yields complete CIA impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Support Genix - Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guest_ticket_login() function and its p parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit wp_rand(10, 99) values and a Unix timestamp via md5() - yielding approximately 19.5 bits of entropy - combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable /sgnix/?p=<token> endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent {ticket_id, ticket_user} token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes wp_set_auth_cookie() to be called for that administrator, granting the attacker full administrative access to the WordPress site.
Executive ViewAI
Support Genix WordPress plugin (versions through 1.4.52) allows attackers with subscriber access to obtain full administrator credentials through a cryptographic weakness, enabling complete compromise of WordPress installations. Organizations running this plugin on customer-facing or internal support systems face immediate risk of data breach, system control loss, and operational disruption. No vendor patch is available, making immediate mitigation mandatory.
No vendor-released patch identified at time of analysis. Recommended interim mitigations: (1) Block unauthenticated /sgnix/?p=* endpoint access via WAF or reverse proxy; (2) Restrict guest ticket token generation to whitelisted IP addresses; (3) Enable and monitor WordPress admin audit logs for unauthorized account changes; (4) Enforce multi-factor authentication on all administrator accounts; (5) Consider immediate plugin disablement if guest ticket functionality is not operationally critical; (6) Monitor for guest ticket tokens in web server access logs indicating exploit attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB