CVE-2026-11590 is a SQL injection vulnerability in the WP Support Plus Responsive Ticket System WordPress plugin versions up to and including 9.1.2. The issue arises because the plugin does not properly sanitize user-supplied array keys before using them in SQL statements. This flaw enables unauthenticated attackers to inject SQL code, potentially leading to unauthorized disclosure of sensitive information. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. There is no official patch or remediation guidance currently available from the vendor, and no known exploits have been reported in the wild.

Successful exploitation allows unauthenticated attackers to perform SQL injection attacks, which can lead to unauthorized disclosure of sensitive data from the database. The CVSS vector indicates a confidentiality impact but no impact on integrity or availability. This poses a significant risk to data confidentiality for sites using affected versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the plugin if possible or applying custom input validation to sanitize array keys before they reach the database queries. Monitor vendor channels for updates and patches addressing this vulnerability.