CVE-2025-30777 Overview
CVE-2025-30777 is an Insecure Direct Object Reference (IDOR) vulnerability in the DevItems Support Genix Lite WordPress plugin. The flaw is classified under [CWE-639] as Authorization Bypass Through User-Controlled Key. It affects all versions of support-genix-lite from an unspecified initial release through 1.4.11.
The vulnerability allows authenticated users with low privileges to bypass access controls by manipulating object identifiers in requests. This results in unauthorized interaction with support ticket data belonging to other users.
Critical Impact
Authenticated attackers can access or modify support resources owned by other users by supplying identifiers they do not legitimately control.
Affected Products
- DevItems Support Genix Lite plugin for WordPress
- All versions up to and including 1.4.11
- WordPress sites running the support-genix-lite helpdesk plugin
Discovery Timeline
- 2025-03-27 - CVE-2025-30777 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30777
Vulnerability Analysis
The Support Genix Lite plugin provides helpdesk and support ticket functionality for WordPress. Endpoints that operate on ticket objects rely on identifiers supplied in the request without validating that the requesting user owns or is authorized to interact with the referenced object.
An attacker with a valid low-privilege account, such as a subscriber or standard support user, can substitute another user's ticket identifier in a request. The application processes the request using the attacker-controlled key, granting access to resources outside the attacker's authorization boundary. The confidentiality impact is limited, while integrity effects allow modification of referenced records.
Root Cause
The root cause is missing server-side authorization checks that bind ticket identifiers to the authenticated user session. The plugin trusts the client-supplied object reference and does not enforce ownership or capability verification before returning or modifying data. This pattern aligns directly with [CWE-639] Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session with low privileges. The attacker enumerates or guesses ticket identifiers, then issues requests substituting those identifiers into vulnerable plugin endpoints. No user interaction from the victim is needed. Refer to the Patchstack WordPress Vulnerability database entry for advisory context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-30777
Indicators of Compromise
- Requests to Support Genix Lite endpoints containing ticket IDs that do not correlate with the authenticated user's ticket history.
- Sequential or enumerative access patterns targeting ticket identifiers from a single low-privilege account.
- Unexpected modifications to support tickets performed by accounts that did not open them.
Detection Strategies
- Review WordPress access logs for authenticated requests to support-genix-lite handlers referencing object IDs across multiple user boundaries.
- Correlate WordPress user session identifiers with the ticket IDs accessed to surface cross-account activity.
- Deploy a Web Application Firewall (WAF) rule to flag high-volume identifier iteration against plugin endpoints.
Monitoring Recommendations
- Monitor plugin-related database tables for update or read operations attributable to non-owning user IDs.
- Alert on anomalous request rates from subscriber-tier accounts targeting helpdesk endpoints.
- Ingest WordPress and web server logs into a centralized analytics platform for cross-account access review.
How to Mitigate CVE-2025-30777
Immediate Actions Required
- Upgrade Support Genix Lite to a version later than 1.4.11 as soon as a patched release is available from DevItems.
- Audit existing support tickets and user accounts for signs of unauthorized access or modification.
- Restrict registration and privilege assignment on affected WordPress sites until the plugin is updated.
Patch Information
The vulnerability affects Support Genix Lite through version 1.4.11. Consult the Patchstack advisory for the current fixed version and vendor patch status. Apply the vendor update through the WordPress plugin manager once released.
Workarounds
- Temporarily deactivate the support-genix-lite plugin if a patched version is not yet available and support functionality is not business-critical.
- Deploy WAF rules that validate the association between authenticated session identifiers and ticket parameters submitted in requests.
- Limit low-privilege account creation and enforce strong session management to reduce the pool of accounts able to exploit the flaw.
# Disable the vulnerable plugin via WP-CLI until a patched version is installed
wp plugin deactivate support-genix-lite
wp plugin status support-genix-lite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
