CVE-2026-19806: CWE-287 Improper Authentication in devitemsllc Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System

CVE-2026-19806 describes an authentication bypass vulnerability in the Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System WordPress plugin. The issue stems from the use of a weak site-wide AES-256-CBC encryption key derived from only three two-digit random values and a timestamp, resulting in approximately 19.5 bits of entropy. Additionally, the encryption uses a deterministic IV and lacks an authentication tag, while the /sgnix/?p=<token> endpoint does not enforce capability checks, nonces, or session validation. Authenticated users with subscriber-level access can use a known guest ticket token as a known-plaintext oracle to exhaustively recover the encryption key offline. They can then forge tokens to impersonate any administrator-owned ticket, triggering wp_set_auth_cookie() and gaining full administrative access to the WordPress site.

Successful exploitation allows an attacker with minimal privileges (subscriber-level) to escalate to full administrator access on the WordPress site. This compromises confidentiality, integrity, and availability of the site, enabling complete control over content, user accounts, and potentially the underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the /sgnix/?p= endpoint. Avoid exposing guest ticket tokens publicly. Follow vendor updates closely for a security patch or official mitigation.