CVE-2026-3985
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress versions up to 1.6.9 contains an SQL injection vulnerability via the 'checkout_uuid' parameter. This is due to insufficient escaping and lack of proper query preparation in the has_checkout_consent() method.
Risk Assessment
An unauthenticated attacker can append additional SQL queries to existing queries, enabling extraction of sensitive information from the database, such as customer data and passwords.
Recommendation
Immediately update the Creative Mail plugin to version 1.7.0 or later, which fixes this vulnerability.
Other vulnerabilities in Creative Mail
See all- CVE-2026-3430High
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
- CVE-2026-65547High
SQL Injection vulnerability in Creative Mail plugin up to version 1.6.9. An attacker with subscriber role can inject SQL queries.
Original NVD description (English source)
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.