WP Support Plus EUVD-2026-40263

No special conditions beyond having the WP Support Plus Responsive Ticket System plugin (version ≤9.1.2) installed and active on a reachable WordPress site - exploitation is remote and unauthenticated (PR:N, UI:N) against default configurations. The concrete prerequisite is that the request reaches the vulnerable handler that consumes user-supplied ARRAY KEYS in a SQL statement, so the payload must be delivered as a PHP array parameter (e.g. param[<SQL>]=...) rather than a normal scalar value. Limiting factors: the impact as scored is confidentiality-only (data disclosure), so this yields read access rather than direct RCE or data destruction; exploitation also requires the plugin to be installed (a non-universal WordPress add-on), and successful data extraction via blind injection may require multiple automated requests.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case reachability profile: network-exploitable, low complexity, no privileges, no user interaction - a recipe for opportunistic, automatable exploitation, and publicly available exploit code raises the practical likelihood. However, EPSS is only 0.18% (7th percentile) and the CVE is NOT in CISA KEV, indicating no observed widespread or confirmed active exploitation to date. The vendor scored it 8.6 by setting Scope:Changed (S:C); a more conservative reading treats database-only SQLi as S:U, which yields ~7.5 - so the headline severity is partly a function of the scope debate, not impact (only C:H; I:N/A:N). Net: a credible, easily exploitable confidentiality risk for any site running this plugin, but real-world exploitation pressure currently appears low/targeted rather than mass-scale. Note conflict to verify: SQLi can often enable data modification, yet the input asserts I:N - verify whether stacked/UPDATE queries are reachable.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable WP Support Plus endpoint, supplying request parameters as PHP arrays whose KEY contains SQL syntax (e.g. a UNION or boolean/time-based blind payload). The malicious key is concatenated into the backend query, letting the attacker exfiltrate wp_users credentials and other database contents. Public exploit code exists, lowering the skill barrier for automated, large-scale scanning.