Authentication Bypass in Support Genix WordPress Plugin

The Support Genix plugin for WordPress (all versions up to and including 1.4.52) contains a critical cryptographic weakness in its guest_ticket_login() function. The plugin derives its site-wide AES-256-CBC encryption key using low-entropy inputs, specifically three two-digit random integers and a Unix timestamp hashed with md5(). This results in approximately 19.5 bits of entropy, which allows an attacker with subscriber-level access to exhaust the 729,000-candidate keyspace offline.

The vulnerability is exposed via the publicly accessible /sgnix/?p=<token> endpoint, which lacks nonces, capability checks, or session validation. By obtaining a single legitimate guest ticket token, an attacker can perform a known-plaintext attack to recover the site-wide encryption key. Once the key is recovered, the attacker can forge a ticket token for any administrator-owned ticket. Submitting this forged token to the endpoint triggers wp_set_auth_cookie() for the target administrator, granting the attacker full administrative access to the site.

Attack Chain

1. Attacker obtains a legitimate guest ticket token to serve as a known-plaintext oracle.
2. Attacker retrieves site metadata to estimate the plugin activation timestamp.
3. Attacker uses the known-plaintext and estimated timestamp to perform an offline brute-force attack on the 729,000-candidate keyspace.
4. Attacker successfully recovers the site-wide AES-256-CBC encryption key.
5. Attacker crafts a forged ticket token referencing a target administrator user ID and ticket ID.
6. Attacker sends an HTTP GET request to the /sgnix/?p= endpoint with the forged token as the parameter.
7. The plugin fails to validate the token's origin or authenticity and invokes wp_set_auth_cookie() for the administrator.
8. The WordPress site grants the attacker administrative privileges, completing the account takeover.

Impact

Successful exploitation allows unauthenticated or low-privileged attackers to gain full administrative access to WordPress sites running the vulnerable plugin. This enables complete site takeover, including the ability to exfiltrate data, modify content, install malicious themes or plugins, and establish persistence, affecting any organization relying on the Support Genix plugin for helpdesk operations.

Recommendation

Update the Support Genix WordPress plugin to a version released after 1.4.52 to remediate the cryptographic flaw. Until patching is possible, restrict access to the /sgnix/ endpoint via web application firewall (WAF) rules or server-side configuration to prevent unauthenticated access. Monitor web server access logs for anomalous GET requests to /sgnix/ that contain unusually long or repetitive p parameter values.