The WP Support Plus Responsive Ticket System plugin fails to sanitize array keys supplied by users before embedding them into a database query. This omission permits attackers to inject arbitrary SQL code, which can be executed against the backend database. A successful injection could allow the attacker to read, alter, or delete ticket data, potentially exposing sensitive information or disrupting ticket processing.

Any WordPress site running WP Support Plus Responsive Ticket System version 9.1.2 or earlier is affected. Administrators should confirm the installed plugin version; newer releases contain a fix. No specific CPE identifiers are available in the current data.

The vulnerability can be exploited by anyone who can send HTTP requests to the site, making the attack vector purely web‑based. Because authentication is not required, an attacker can craft requests that set filter[elements] array keys to malicious SQL payloads. The EPSS score is not available, but the lack of credential requirement and the potential for data tampering classify this as high risk. It is not listed in CISA KEV. An attacker can trigger the vulnerability by submitting malicious form data or URL parameters, resulting in unauthorized database access.