WordPress Plugin SQL Injection via Unsanitized Array Keys

The WP Support Plus Responsive Ticket System plugin through version 9.1.2 contains a critical SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands. The flaw stems from insufficient input sanitization of array keys before they're incorporated into SQL statements—a common but severe oversight in WordPress plugin development. This vulnerability affects any WordPress installation running the vulnerable plugin version, putting customer support systems and their associated data at immediate risk. With a CVSS score of 8.6, this represents a high-severity threat that requires urgent patching across affected deployments.

While CVE-2026-11590 doesn't currently map to specific MITRE ATT&CK techniques in the database, Casky's extended reasoning capabilities would detect attack patterns consistent with T1190 (Exploit Public-Facing Application) and T1557 (Man-in-the-Middle) when analyzing suspicious query patterns and data exfiltration attempts. Practitioners leveraging Casky's 754 security skills would observe indicators such as malformed array parameters in HTTP requests to the plugin's endpoints, unexpected SQL syntax fragments in access logs, unusual database query volumes, and potential data extraction attempts in server responses. The platform's Claude AI engine, through careful pattern analysis, would surface these behavioral anomalies even as new exploitation variants emerge—enabling security teams to identify compromised systems before full data breach occurs.