CVE-2025-58635: Support Genix Auth Bypass Vulnerability

CVE-2025-58635 Overview

CVE-2025-58635 is a Missing Authorization vulnerability [CWE-862] affecting the DevItems Support Genix WordPress plugin (support-genix-lite). The flaw stems from incorrectly configured access control security levels within the plugin, allowing unauthenticated network attackers to access functionality that should require authorization. The vulnerability affects Support Genix versions from n/a through 1.4.23.

An attacker can exploit this issue over the network without authentication or user interaction. Successful exploitation results in limited integrity impact, enabling unauthorized modifications to plugin-managed resources. Site administrators running vulnerable versions should treat this as a broken access control issue on internet-facing WordPress installations.

Critical Impact
Unauthenticated attackers can bypass access controls in the Support Genix plugin to perform actions that should be restricted to authorized users, resulting in integrity impact on affected WordPress sites.

Affected Products

DevItems Support Genix (support-genix-lite) — versions up to and including 1.4.23
WordPress sites with the Support Genix Lite plugin installed and activated
Any Support Genix deployment prior to the vendor-provided fix

Discovery Timeline

2025-09-03 - CVE-2025-58635 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58635

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness [CWE-862] in the Support Genix support ticket plugin for WordPress. The plugin exposes functionality that fails to verify whether the requesting user holds the appropriate capability or role before executing sensitive operations. Because the access control check is missing or incorrectly configured, requests originating from unauthenticated sources reach code paths intended for privileged users.

This class of flaw is common in WordPress plugins that register AJAX handlers or REST endpoints without applying current_user_can() checks or nonce verification. The attack requires no privileges and no user interaction, and it is exploitable directly over HTTP. The confidentiality and availability impacts are rated as none, while integrity impact is limited, indicating attackers can alter certain plugin-managed data but cannot read sensitive content or take the site offline through this vector alone.

Root Cause

The root cause is an incorrectly configured access control layer inside support-genix-lite. One or more request handlers omit authorization enforcement, permitting anonymous requests to invoke actions reserved for authenticated support agents or administrators. The EPSS score of 0.209% reflects a low current probability of exploitation activity in the wild, but the low complexity keeps the attack surface accessible.

Attack Vector

An attacker sends crafted HTTP requests to vulnerable Support Genix endpoints on a target WordPress site. Because authorization is missing, the plugin processes the request as if it originated from a legitimate user. The attacker can then modify plugin state — such as ticket data, settings, or related records — within the scope permitted by the unprotected handler.

No verified public proof-of-concept is currently available for CVE-2025-58635. Refer to the Patchstack Vulnerability Report for additional technical context on the affected code paths.

Detection Methods for CVE-2025-58635

Indicators of Compromise

Unauthenticated HTTP POST requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) referencing Support Genix actions
Unexpected creation, modification, or deletion of support tickets or plugin settings without corresponding authenticated user sessions
Requests to Support Genix REST routes originating from unusual IP addresses or user-agent strings

Detection Strategies

Review WordPress access logs for anonymous requests targeting support-genix-lite action names or REST namespaces
Enable WordPress audit logging to record ticket state changes and correlate them against authenticated user activity
Compare current plugin version against 1.4.23 across all managed WordPress sites to identify vulnerable installations

Monitoring Recommendations

Monitor web server logs for spikes in requests to admin-ajax.php with Support Genix action parameters
Alert on modifications to plugin database tables that occur outside of expected administrative windows
Deploy a web application firewall rule set that flags unauthenticated access to plugin endpoints requiring privileges

How to Mitigate CVE-2025-58635

Immediate Actions Required

Identify all WordPress sites running Support Genix support-genix-lite version 1.4.23 or earlier
Update the plugin to a version above 1.4.23 once the vendor publishes a fixed release
If a patched version is not yet available, deactivate and remove the plugin from production sites until remediated

Patch Information

The Patchstack advisory tracks fixed versions for CVE-2025-58635. Administrators should consult the Patchstack Vulnerability Report for the latest fixed-version guidance and apply updates through the WordPress plugin management interface.

Workarounds

Restrict access to Support Genix endpoints at the web application firewall or reverse proxy layer until patched
Limit exposure of /wp-admin/admin-ajax.php and REST API routes to authenticated sessions where feasible
Audit user roles and capabilities to ensure that only trusted accounts can interact with the support ticketing workflow

bash

# Configuration example: block unauthenticated access to Support Genix AJAX actions via Nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "support_genix") {
        # Require an authenticated WordPress cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}