CVE-2026-65547
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
SQL Injection vulnerability in Creative Mail plugin up to version 1.6.9. An attacker with subscriber role can inject SQL queries.
Risk Assessment
Potential unauthorized access to the database, data leakage or modification by a low-privileged user.
Recommendation
Update the Creative Mail plugin to the latest patched version.
Other vulnerabilities in Creative Mail
See all- CVE-2026-3430High
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
- CVE-2026-3985High
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress versions up to 1.6.9 contains an SQL injection vulnerability via the 'checkout_uuid' parameter. This is due to insufficient escaping and lack of proper query preparation in the has_checkout_consent() method.
Original NVD description (English source)
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.