Authentication Bypass in Support Genix Helpdesk Plugin for WordPress

CVE-2026-19806

What is CVE-2026-19806?

The Support Genix Helpdesk plugin for WordPress has a critical vulnerability that allows an attacker to bypass authentication and take control of an administrator account. This issue arises from insufficient encryption key generation, where site-wide keys are derived from limited entropy values. By exploiting the 'guest_ticket_login()' function and its 'p' parameter, an authenticated attacker with minimal privileges can use a valid guest ticket to recover the encryption key offline. This leads to the forgery of administrator session tokens, effectively granting the attacker full administrative access to the WordPress site. This vulnerability affects all versions up to and including 1.4.52.

References