CVE-2026-11590: WP Support Plus SQLi Vulnerability

CVE-2026-11590 Overview

CVE-2026-11590 is an unauthenticated SQL injection vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2. The plugin fails to sanitize user-supplied array keys before incorporating them into SQL statements. Attackers can send crafted requests to inject arbitrary SQL syntax without authentication. Successful exploitation allows extraction of sensitive database contents, including WordPress user credentials, session tokens, and plugin configuration data. The flaw maps to SQL Injection [CWE-89] and requires no user interaction.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, exposing confidential data across all sites running the vulnerable plugin.

Affected Products

WP Support Plus Responsive Ticket System WordPress plugin versions through 9.1.2
WordPress installations with the plugin activated
Any site exposing the plugin's request handlers to unauthenticated traffic

Discovery Timeline

2026-06-30 - CVE-2026-11590 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-11590

Vulnerability Analysis

The vulnerability resides in the WP Support Plus Responsive Ticket System plugin's handling of request parameters passed as PHP arrays. The plugin reads array keys from user input and concatenates them directly into SQL statements. Because WordPress's $wpdb->prepare() mechanism sanitizes values but not identifier keys, an attacker who supplies malicious array keys injects arbitrary SQL fragments into the resulting query.

The attack requires no authentication, no user interaction, and can be executed remotely over the network. The scope is marked as changed, indicating that a successful attack can affect resources beyond the vulnerable component's security scope. The current EPSS score is 0.262%.

Root Cause

The root cause is missing sanitization of array key identifiers used within SQL clauses such as WHERE, ORDER BY, or column selectors. Developers relied on parameter binding for values but treated keys as trusted. This assumption breaks when user input controls the array structure itself, permitting injection of SQL syntax through key names.

Attack Vector

An attacker submits an HTTP POST or GET request to a plugin endpoint with a parameter formatted as an associative array. Instead of supplying benign key names, the attacker supplies keys containing SQL operators, comments, and payloads. The plugin interpolates these keys into a query, causing the injected SQL to execute with the database privileges of the WordPress user. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-11590

Indicators of Compromise

HTTP requests to WP Support Plus endpoints containing array-notation parameters with SQL keywords such as UNION, SELECT, SLEEP, or -- embedded in the key portion
Unexpected wp_users or wp_options read patterns in MySQL slow query or general query logs
Web server access logs showing repeated requests to plugin AJAX handlers from a single IP with encoded bracket notation
Creation of unauthorized administrator accounts following anomalous plugin traffic

Detection Strategies

Deploy WAF rules that inspect array-key names in request bodies, not only values, for SQL syntax
Enable MySQL query logging and alert on queries containing suspicious identifiers referencing authentication tables
Correlate WordPress wp-admin login anomalies with prior traffic to WP Support Plus endpoints

Monitoring Recommendations

Monitor plugin request rates and flag sudden spikes from single sources
Alert on outbound database dumps or bulk row reads occurring outside normal application patterns
Track new administrative user creation events in WordPress audit logs

How to Mitigate CVE-2026-11590

Immediate Actions Required

Deactivate and remove the WP Support Plus Responsive Ticket System plugin until a fixed version is confirmed available
Rotate all WordPress administrator passwords and invalidate active sessions
Review database contents for unauthorized user accounts, altered options, or exfiltration indicators
Apply a WAF virtual patch that blocks SQL metacharacters in array parameter keys

Patch Information

At the time of publication, the vendor advisory referenced in the WPScan Vulnerability Report indicates the plugin is affected through version 9.1.2. Administrators should consult the plugin repository for an updated release that sanitizes array keys before use in SQL statements.

Workarounds

Restrict access to plugin endpoints via .htaccess or reverse proxy rules limiting them to authenticated IP ranges
Deploy ModSecurity or equivalent WAF signatures that reject request parameters containing bracketed keys with SQL syntax
Replace WP Support Plus with an alternative ticketing plugin from a maintained vendor

bash

# Example ModSecurity rule blocking SQL syntax in array keys
SecRule ARGS_NAMES "@rx (?i)(union|select|sleep|--|/\*)" \
    "id:1026115,phase:2,deny,status:403,\
    msg:'CVE-2026-11590 WP Support Plus SQLi attempt in array key'"