What is the CVSS score of CVE-2026-11590?

CVE-2026-11590 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of WP Support Plus are affected by CVE-2026-11590?

WP Support Plus Responsive Ticket System plugin (all versions through 9.1.2) contains an unauthenticated SQL injection vulnerability enabling password hash extraction and unauthorized database…

Is there a public PoC exploit available for CVE-2026-11590?

Yes, a public proof-of-concept exploit is available for CVE-2026-11590. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-11590?

Within 24 hours: Identify all WordPress instances using WP Support Plus Responsive Ticket System plugin and disable it on non-critical systems. Within 7 days: For retained installations, implement Web Application Firewall rules blocking SQL injection payloads, rotate database credentials, and enable database query logging to detect exploitation attempts. Within 30 days: Monitor vendor for patch release and either apply immediately upon availability or migrate to an alternative support ticket plugin.

WP Support Plus CVE-2026-11590

EUVD-2026-40263 HIGH

2026-06-30 WPScan

GHSA-fjmg-grxw-25vg

WordPress SQLi Wp Support Plus Responsive Ticket System Unknown

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated low-complexity SQLi (AV:N/AC:L/PR:N/UI:N) with database-only read impact, so C:H and S:U rather than the vendor's S:C; I/A:N as no confirmed write/destruction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 15:24 vuln.today

CVSS changed

Jun 30, 2026 - 15:22 NVD

8.6 (HIGH)

CVE Published

Jun 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 06:00 cve.org

HIGH 8.6

DescriptionCVE.org

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 2 Critical, 5 High, 2 With POC Jul 01, 2026

AnalysisAI

Unauthenticated SQL injection in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2) lets remote attackers inject arbitrary SQL by abusing user-supplied array keys that are passed into a query without sanitization. Any unauthenticated visitor can extract sensitive database contents such as WordPress user records and password hashes. Publicly available exploit code exists, though EPSS rates exploitation probability low (0.18%, 7th percentile) and it is not on CISA KEV.

Technical ContextAI

The flaw is a classic SQL injection (CWE-89, not populated in the input) in a WordPress plugin built on the standard $wpdb database abstraction layer. The specific defect is unusual: rather than an unsanitized value, the plugin uses attacker-controlled array KEYS (e.g. parameter names submitted as PHP array structures) directly inside a SQL statement. Because PHP automatically casts request parameters like name[KEY]=value into array keys, an attacker can smuggle SQL syntax through the key name itself, bypassing typical value-focused input filtering. The CPE cpe:2.3:a:unknown:wp_support_plus_responsive_ticket_system:*:*:*:*:*:*:*:* identifies the affected component with an unknown/unregistered vendor, consistent with a community plugin.

RemediationAI

No vendor-released patch or fixed version is identified in the available data for versions through 9.1.2, so a clean upgrade target cannot be confirmed; monitor the WordPress plugin repository and the WPScan advisory (https://wpscan.com/vulnerability/117853ca-0fd3-4bfa-ad60-799eb5c77bdf/) for a release above 9.1.2 and apply it immediately once published. As compensating controls, deploy a WAF rule that blocks SQL metacharacters in request parameter names/array keys for the plugin's endpoints (trade-off: array-key inspection is not standard in many WAF rulesets and may need a custom rule); restrict access to the plugin's AJAX/handler endpoints or temporarily deactivate the WP Support Plus plugin if the ticketing feature is non-essential (trade-off: disables customer support functionality); and place the affected admin/AJAX routes behind authentication or IP allow-listing where the workflow permits (trade-off: breaks unauthenticated end-user ticket submission). Also rotate WordPress credentials and database secrets afterward, since unauthenticated SQLi may already have exposed user hashes.