A critical authentication bypass vulnerability in the Support Genix WordPress plugin allows authenticated users to achieve full administrative account takeover.

The vulnerability exists in the guest_ticket_login function, where insufficient entropy in the site wide encryption key generation allows an attacker with subscriber level access to brute force the key offline and forge authentication tokens. This flaw permits the attacker to bypass all security checks and gain full administrative privileges without legitimate credentials.

The exploitation of this vulnerability results in a complete compromise of the WordPress site, as the attacker gains full administrative control. This level of access enables the theft of sensitive customer data, the installation of malicious backdoors, and the potential for long term persistence within the network. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity and data confidentiality.

Immediate Action: Update the Support Genix plugin to version 1.4.53 or later immediately to resolve the cryptographic weakness.

Proactive Monitoring: Monitor site access logs for unusual patterns or spikes in traffic directed toward the /sgnix/ endpoint, which may indicate automated token brute forcing attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block suspicious requests targeting the plugin's query parameters if an immediate update is not feasible.

Public Exploit Available: No (exploit_available unknown).

Given the potential for total administrative takeover, organizations utilizing this plugin must prioritize the update to version 1.4.53. Failure to patch this vulnerability leaves the entire WordPress environment exposed to full unauthorized control by any authenticated user on the platform.