EUVD-2026-54088
GHSA-r882-fcw9-3344
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable unauthenticated endpoint; abandoned cart feature is core plugin function (AC:L); scope change reflects cross-boundary DB read; no write or availability impact confirmed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
AnalysisAI
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Creative Mail plugin (versions 1.6.5-1.6.9) be installed and active on a WordPress site AND that the abandoned cart email feature be managed by Creative Mail. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is elevated despite the absence of a CISA KEV listing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to the Creative Mail abandoned cart email endpoint, injecting SQL metacharacters into the unsanitized parameter. The unparameterized query executes against the WordPress MySQL database, returning sensitive data - including hashed credentials, WooCommerce customer records, and plugin-stored API keys. … |
| Remediation | The primary remediation is to update the Creative Mail plugin to a version beyond 1.6.9 via the WordPress plugin dashboard; however, no specific patched version number is independently confirmed from the available data - verify the latest release in the WordPress plugin repository before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress installations to identify deployments of Creative Mail plugin versions 1.6.5-1.6.9 and immediately disable the abandoned cart email feature as a stopgap containment measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Creative Mail
View allMultiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. Rated high sev
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today