CVE-2026-11590

HIGH

WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11590. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-11590, a SQL injection vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin (versions through 9.1.2). The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing only a WPScan entry for details.

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-11590_the_support_plus.py

This repository contains an auto-generated stub module for CVE-2026-11590, a SQL injection vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin (versions through 9.1.2). The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing only a WPScan entry for details.

Classification
Stub 99%
Attack Type
Sqli
Complexity
Moderate
Reliability
Theoretical
Target: WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2
No auth needed
Prerequisites: Unauthenticated network access to the target WordPress site · WP Support Plus plugin installed (versions ≤ 9.1.2)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/117853ca-0fd3-4bfa-ad60-799eb5c77bdf/

Scores

CVSS v3 8.6
EPSS 0.0026
EPSS Percentile 17.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

Status published
Products (1)
None/WP Support Plus Responsive Ticket System < 9.1.2
Published Jun 30, 2026
Tracked Since Jun 30, 2026