What is the CVSS score of CVE-2026-3985?

CVE-2026-3985 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Creative Mail Plugin are affected by CVE-2026-3985?

The Creative Mail email marketing plugin (versions ≤1.6.9) used in WordPress and WooCommerce installations contains an unauthenticated SQL injection vulnerability that allows attackers to extract…

How to fix or mitigate CVE-2026-3985?

24 hours: Conduct inventory of all WordPress/WooCommerce installations running Creative Mail plugin versions 1.6.9 and below. 7 days: Disable or uninstall the vulnerable plugin, or if operationally critical, implement Web Application Firewall rules to block requests containing the 'checkout_uuid' parameter. 30 days: Monitor vendor security advisories for patch availability; upon release of patched version, prioritize immediate deployment across all instances.

Creative Mail Plugin CVE-2026-3985

EUVD-2026-31018 HIGH

SQL Injection (CWE-89)

2026-05-20 Wordfence

GHSA-mqm2-57wm-gj43

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:30 vuln.today

DescriptionCVE.org

The Creative Mail - Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the has_checkout_consent() method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in the Creative Mail - Easier WordPress & WooCommerce Email Marketing plugin (versions up to and including 1.6.9) allows remote attackers to append arbitrary SQL clauses through the 'checkout_uuid' parameter handled by the has_checkout_consent() method. The flaw stems from missing escaping and the absence of a prepared statement, enabling extraction of sensitive database contents from any WordPress site running the vulnerable plugin. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The Creative Mail plugin, distributed by Constant Contact, integrates WordPress and WooCommerce stores with the Creative Mail email marketing service. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in the DatabaseManager.php file at line 298, where the 'checkout_uuid' value supplied via the CheckoutManager flow is interpolated into a SQL query without being passed through wpdb::prepare() or properly escaped. Because WordPress plugins execute queries with the database privileges of the WordPress user, any successful injection can read across the wp_users, wp_usermeta, and WooCommerce order tables, which typically contain password hashes, session tokens, and customer PII.

RemediationAI

No vendor-released patch identified at time of analysis - the provided references point only to the vulnerable 1.6.9 tag and trunk, not to a tagged fixed release, so administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/39c17935-a853-407f-a99d-3828561919e6?source=cve and the plugin's WordPress.org page for an update beyond 1.6.9 and upgrade as soon as it ships. Until a fix is available, deactivate and remove the Creative Mail plugin if email marketing automation is non-critical (trade-off: loss of Constant Contact integration and abandoned-cart consent flows), or front the site with a WAF (Wordfence, Cloudflare, Sucuri) configured to block SQL meta-characters in the 'checkout_uuid' parameter (trade-off: legitimate UUIDs are alphanumeric-with-hyphens, so strict allowlisting is feasible but may need tuning for any non-standard checkout flows). Additionally restrict direct database account privileges to the minimum WordPress requires and rotate any secrets that may have been exposed if exploitation is suspected.