Support Genix vulnerabilities

The Support Genix plugin (up to version 1.4.54) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

The Support Genix plugin for WordPress up to version 1.4.52 is vulnerable to authentication bypass leading to administrator account takeover via the guest_ticket_login() function and its p parameter. The site-wide AES-256-CBC encryption key is derived from only three two-digit wp_rand(10, 99) values and a Unix timestamp via md5(), yielding approximately 19.5 bits of entropy, combined with a deterministic IV. This allows authenticated attackers with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle, to recover the encryption key and forge a token for an administrator, leading to full administrative access.

The Support Genix WordPress plugin before version 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension, including other users' private ticket attachments.