CVE-2026-11590
Received Received - Intake

SQL Injection in WP Support Plus Responsive Ticket System

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: WPScan

Description
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-06-30
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-11590
EUVD
EUVD-2026-40263

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_support_plus responsive_ticket_system to 9.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-11590 affects the WordPress plugin "WP Support Plus Responsive Ticket System" versions 9.1.2 and earlier.

It is an unauthenticated SQL injection flaw caused by the plugin not properly sanitizing user-supplied array keys before using them in SQL queries.

This means attackers can manipulate database queries without needing to be authenticated.

Impact Analysis

This vulnerability allows unauthenticated attackers to perform SQL injection attacks on the affected WordPress plugin.

Such attacks can lead to unauthorized access, data manipulation, or data leakage from the website's database.

Because the vulnerability has a high severity rating with a CVSS score of 8.6, it poses a significant security risk.

Mitigation Strategies

The vulnerability affects versions 9.1.2 and earlier of the WP Support Plus Responsive Ticket System plugin and allows unauthenticated SQL injection due to improper sanitization of user input.

Since no known fix is currently available, immediate mitigation steps include:

  • Disable or deactivate the vulnerable plugin until a patch or update is released.
  • Restrict access to the WordPress installation or plugin endpoints to trusted users or IP addresses.
  • Monitor your system for unusual database activity or signs of exploitation.
  • Keep backups of your site and database to enable recovery in case of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart