# CVE-2026-11590: WP Support Plus Responsive Ticket System unauthenticated SQL injection

Source: https://junglewise.ai/threats/cve-2026-11590-wp-support-plus-responsive-ticket-system-unauthenticated-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-11590 · Severity: info · CVSS 8.6 · Published 2026-06-30

The WP Support Plus Responsive Ticket System plugin for WordPress, which provides customer support ticketing functionality, contains a security flaw that allows unauthorized individuals to access or modify the website's database. By sending a specially crafted request, an attacker could steal sensitive customer information, administrative credentials, or disrupt the site's operations. This vulnerability is particularly serious because it can be exploited by anyone on the internet without needing a login account.

Technologies: [WP Support Plus Responsive Ticket System](https://junglewise.ai/threats/technologies/wp-support-plus-responsive-ticket-system). Vendors: [WP Support Plus](https://junglewise.ai/threats/vendors/wp-support-plus).

## Quick answers

**Is CVE-2026-11590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11590 being exploited in the wild.

**How severe is CVE-2026-11590?** Informational severity, with a CVSS score of 8.6, published 30 June 2026.

**Which products and versions are affected?** WP Support Plus Responsive Ticket System <= 9.1.2.

**Is there a fix for CVE-2026-11590?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11590 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11590?** Check whether you run WP Support Plus Responsive Ticket System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP Support Plus Responsive Ticket System plugin (up to version 9.1.2) is vulnerable to an unauthenticated SQL injection. The root cause is the failure to sanitize or validate user-supplied array keys within the 'filter[elements]' parameter before incorporating them into a SQL query. An attacker can exploit this by sending a crafted network request to the affected WordPress site, allowing for the execution of arbitrary SQL commands. This can lead to full database compromise, including the extraction of sensitive data or modification of records. As of the advisory date, there is no known fix or patch available for this issue.

## Affected products

- Unknown WP Support Plus Responsive Ticket System <= 9.1.2

## Timeline

- 2026-06-09: disclosed: Vulnerability publicly published by WPScan.
- 2026-06-30: advisory: CVE-2026-11590 published in the NVD.

## References

- [https://wpscan.com/vulnerability/117853ca-0fd3-4bfa-ad60-799eb5c77bdf/](https://wpscan.com/vulnerability/117853ca-0fd3-4bfa-ad60-799eb5c77bdf/)

## Related threats

- [WP Support Plus Responsive Ticket System session cookie forgery](https://junglewise.ai/threats/cve-2026-11875-wp-support-plus-responsive-ticket-system-session-cookie-forgery)
- [WP Support Plus Responsive Ticket System unauthenticated stored XSS via file upload](https://junglewise.ai/threats/cve-2026-11589-wp-support-plus-responsive-ticket-system-unauthenticated-stored)