CVE-2026-19806
Received Received - Intake

Authentication Bypass in Support Genix WordPress Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Wordfence

Description
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19806
EUVD
EUVD-2026-68969

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
genix helpdesk to 1.4.52 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the Support Genix WordPress plugin that allows attackers to take over administrator accounts. It exists due to weak encryption key generation using only three two-digit random values and a timestamp, making the keyspace small enough to brute force. Attackers can forge tokens to gain full admin access.

Detection Guidance

Check for unauthorized administrator accounts or unusual activity in WordPress user roles. Inspect network traffic for requests to the vulnerable endpoint /sgnix/?p=<token>. Review plugin versions and look for the Support Genix plugin up to 1.4.52.

Impact Analysis

If you use the vulnerable plugin, attackers with subscriber-level access can exploit this to gain full administrative control of your WordPress site. This could lead to complete site takeover, data theft, malware installation, or defacement.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls.

Mitigation Strategies

Immediately update the Support Genix plugin to the latest version beyond 1.4.52. Remove any unauthorized administrator accounts. Disable guest ticket functionality if not required. Monitor for suspicious activity and consider rotating encryption keys if exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart