Administrator takeover via forged guest ticket token

Authentication bypass in HasThemes Support Genix 1.4.52 and earlier allows remote authenticated users to take over administrator accounts. The guest_ticket_login() path accepts p ciphertext encrypted with a site-wide AES-256-CBC key derived from roughly 729,000 candidates and authenticates ticket_user without capability, nonce, session, or integrity checks. Subscriber access, one legitimate guest token, and a bounded activation time let attackers recover the key offline, forge an administrator token, and receive that administrator's WordPress authentication cookie.