CVE-2026-3430
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
Risk Assessment
The risk includes the possibility of unauthorized access to the database, which could lead to data leakage, modification, or deletion. The attack requires no authentication, so it can be carried out by anyone.
Recommendation
It is recommended to immediately update the Creative Mail plugin to the latest version that contains the fix. Also, check logs for suspicious SQL queries.
Other vulnerabilities in Creative Mail
See all- CVE-2026-65547High
SQL Injection vulnerability in Creative Mail plugin up to version 1.6.9. An attacker with subscriber role can inject SQL queries.
- CVE-2026-3985High
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress versions up to 1.6.9 contains an SQL injection vulnerability via the 'checkout_uuid' parameter. This is due to insufficient escaping and lack of proper query preparation in the has_checkout_consent() method.
Original NVD description (English source)
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.