Creative Mail CVE-2026-3430

Exploitation requires that the Creative Mail plugin (versions 1.6.5-1.6.9) be installed and active on a WordPress site AND that the abandoned cart email feature be managed by Creative Mail. Since abandoned cart recovery is the core advertised function of this plugin, this feature is expected to be enabled on the majority of installations - it is not an obscure optional setting. No authentication is required (CVSS PR:N). No user interaction is required (CVSS UI:N). Network access to the WordPress site's HTTP/HTTPS endpoints is sufficient. Exploitation is limited to sites running the affected version range and where the abandoned cart email functionality is active; WordPress sites that have this plugin installed but have not configured abandoned cart emails may not be vulnerable via this specific parameter.

Real-world risk is elevated despite the absence of a CISA KEV listing. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms network-reachable, unauthenticated exploitation with no user interaction - the highest-severity exploitation conditions. A publicly available exploit code from WPScan (a trusted WordPress security platform) means scripted, automated exploitation is realistic. The C:H/I:N/A:N profile indicates a read-only injection capable of full database exfiltration, including WordPress user password hashes, API keys stored by plugins, and customer PII in WooCommerce deployments. The limiting factor is that the abandoned cart email feature must be active; however, this is a primary use case of the plugin, so it is likely enabled by default on most installations. No EPSS data was provided; given PR:N, AC:L, and public POC, exploitation probability is likely high. CVSS signals and POC availability are consistent and reinforcing - this is a genuine priority for any site running the affected plugin versions.

An unauthenticated attacker sends a crafted HTTP request to the Creative Mail abandoned cart email endpoint, injecting SQL metacharacters into the unsanitized parameter. The unparameterized query executes against the WordPress MySQL database, returning sensitive data - including hashed credentials, WooCommerce customer records, and plugin-stored API keys. Because WPScan has published a proof-of-concept, this attack can be scripted and run at scale against vulnerable WordPress installations.