CVE-2026-19806: Support Genix WordPress Auth Bypass Flaw

CVE-2026-19806 Overview

CVE-2026-19806 is an authentication bypass vulnerability [CWE-287] in the Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress. The flaw affects all versions up to and including 1.4.52. It exists in the guest_ticket_login() function reachable via the /sgnix/?p=<token> endpoint. Authenticated attackers with subscriber-level access can recover the site-wide AES-256-CBC encryption key offline and forge guest ticket tokens targeting administrator-owned tickets. Successful exploitation invokes wp_set_auth_cookie() for the targeted administrator, granting full administrative access.

Critical Impact
Attackers holding a single legitimate guest ticket token can brute-force the ~19.5-bit key space offline and take over any administrator account on the WordPress site.

Affected Products

Support Genix Lite (WordPress plugin) versions ≤ 1.4.52
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
WordPress sites using the /sgnix/ guest ticket login endpoint

Discovery Timeline

2026-09-01 - CVE-2026-19806 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19806

Vulnerability Analysis

The vulnerability originates in the plugin's guest ticket authentication flow. The guest_ticket_login() function accepts a p parameter containing an AES-256-CBC encrypted token describing a {ticket_id, ticket_user} pair. When the token decrypts to a valid ticket owned by any WordPress user, the plugin calls wp_set_auth_cookie() for that user without capability, nonce, or session checks. The endpoint /sgnix/?p=<token> is publicly reachable and lacks CSRF protection.

The encryption implementation compounds the exposure. The site-wide key is derived by md5() over three wp_rand(10, 99) two-digit values plus a Unix timestamp bounded by the plugin activation window. The initialization vector is deterministically derived from the password, and the ciphertext carries no authentication tag. This yields roughly 19.5 bits of entropy across approximately 729,000 candidate keys.

Root Cause

The root cause combines weak cryptographic key derivation with missing authorization on a public endpoint. Predictable wp_rand() inputs, deterministic IV construction, absence of an authenticated encryption mode, and lack of capability or nonce validation on /sgnix/?p= collectively allow forged tokens to authenticate arbitrary users.

Attack Vector

An attacker with subscriber-level access first obtains one legitimate guest ticket token to serve as a known-plaintext oracle. The attacker enumerates the ~729,000-candidate keyspace entirely offline, matching decrypted plaintext against the known token. Once the site-wide key is recovered, the attacker forges a self-consistent {ticket_id, ticket_user} token referencing an administrator-owned ticket and submits it to /sgnix/?p=<forged_token>. The plugin decrypts the token, calls wp_set_auth_cookie() for the administrator, and returns valid session cookies.

See the Wordfence Vulnerability Analysis and the WordPress Code Review - Encryption Lib for the specific code paths.

Detection Methods for CVE-2026-19806

Indicators of Compromise

Requests to /sgnix/?p=<token> from subscriber-authenticated sessions followed by administrator session cookies being issued to the same IP or user agent.
High-volume or automated GET requests to the /sgnix/ endpoint from a single source enumerating token values.
Unexpected administrator logins in the WordPress wp_usermeta and audit logs without corresponding wp-login.php events.

Detection Strategies

Monitor web server logs for /sgnix/?p= requests correlated with newly issued wordpress_logged_in_* cookies for administrator accounts.
Alert on subscriber accounts that pivot to administrator sessions within a short time window from the same source address.
Inspect WordPress audit trails for wp_set_auth_cookie invocations tied to the Support Genix code path.

Monitoring Recommendations

Enable verbose WordPress security logging and forward events to a centralized analytics platform for correlation.
Track baseline request volumes to /sgnix/ and alert on statistically significant deviations.
Continuously review administrator account creation, role changes, and plugin/theme modifications.

How to Mitigate CVE-2026-19806

Immediate Actions Required

Update the Support Genix plugin to a version later than 1.4.52 as soon as the vendor publishes a fixed release.
Audit all administrator accounts and revoke any sessions or credentials created after the vulnerable version was installed.
Restrict subscriber-level registrations if not required for site operations.

Patch Information

Refer to the WordPress Changeset Review and the Wordfence Vulnerability Analysis for the vendor's remediation status. Site owners should upgrade to the first release above 1.4.52 that addresses the key derivation, IV construction, and endpoint authorization defects.

Workarounds

Block or restrict access to the /sgnix/ endpoint at the web server or web application firewall (WAF) layer until a patch is applied.
Disable the Support Genix plugin on production sites that do not require guest ticket functionality.
Force a password reset and rotate any secrets that may have relied on the plugin's encryption library.

bash

# Example nginx location block restricting the vulnerable endpoint
location ~* ^/sgnix/ {
    deny all;
    return 403;
}