Description
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Published: 2026-06-30
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WP Support Plus Responsive Ticket System plugin fails to sanitize array keys supplied by users before embedding them into a database query. This omission permits attackers to inject arbitrary SQL code, which can be executed against the backend database. A successful injection could allow the attacker to read, alter, or delete ticket data, potentially exposing sensitive information or disrupting ticket processing.

Affected Systems

Any WordPress site running WP Support Plus Responsive Ticket System version 9.1.2 or earlier is affected. Administrators should confirm the installed plugin version; newer releases contain a fix. No specific CPE identifiers are available in the current data.

Risk and Exploitability

The vulnerability can be exploited by anyone who can send HTTP requests to the site, making the attack vector purely web‑based. Because authentication is not required, an attacker can craft requests that set filter[elements] array keys to malicious SQL payloads. The EPSS score is < 1 %, and the CVSS score of 8.6 indicates a high severity risk. It is not listed in CISA KEV. An attacker can trigger the vulnerability by submitting malicious form data or URL parameters, resulting in unauthorized database access.

Generated by OpenCVE AI on June 30, 2026 at 16:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update WP Support Plus Responsive Ticket System to a version newer than 9.1.2.
  • If an update cannot be applied immediately, disable or remove the plugin to block the attack surface.
  • Configure the database user needed by WordPress with only the permissions required for the plugin to limit potential damage.
  • Deploy a web application firewall or input‑validation mechanism that sanitizes or blocks SQL injection attempts targeting the filter[elements] array keys.

Generated by OpenCVE AI on June 30, 2026 at 16:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpsupportplus
Wpsupportplus wp Support Plus Responsive Ticket System
Vendors & Products Wordpress
Wordpress wordpress
Wpsupportplus
Wpsupportplus wp Support Plus Responsive Ticket System

Tue, 30 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-89

Tue, 30 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 07:15:00 +0000

Type Values Removed Values Added
Description The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Title WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys
References

Subscriptions

Wordpress Wordpress
Wpsupportplus Wp Support Plus Responsive Ticket System
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-06-30T14:23:36.734Z

Reserved: 2026-06-08T13:39:48.524Z

Link: CVE-2026-11590

cve-icon Vulnrichment

Updated: 2026-06-30T14:23:21.528Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T09:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')