Creative Mail CVE-2026-65547

Exploitation requires a valid subscriber-level WordPress account (PR:L per CVSS), which is the lowest authenticated role. On sites with open user registration enabled (WordPress default allows self-registration), any external attacker can obtain this account without administrator involvement. The Creative Mail plugin must be installed and active on WordPress, running version 1.6.9 or earlier. No special plugin configuration beyond installation is indicated as a prerequisite. Exploitation is blocked entirely on sites where WordPress user registration is disabled, where subscriber accounts are not permitted, or where the plugin is deactivated. The scope change (S:C) means exploitation consequences extend to the full shared WordPress database, not just Creative Mail's own tables.

The CVSS 8.5 score is driven primarily by the S:C scope change and C:H confidentiality impact, reflecting the ability to read across the full WordPress database. The network attack vector (AV:N), low complexity (AC:L), and no user interaction (UI:N) make this straightforward to exploit once a subscriber account exists. However, PR:L is a meaningful constraint: an attacker must hold a valid subscriber account, which limits opportunistic mass exploitation compared to unauthenticated vectors. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, meaning confirmed active exploitation has not been reported. No POC availability is confirmed from available data. The realistic priority is elevated for WordPress sites with open subscriber registration, and lower for sites where registration is disabled or tightly controlled. The I:N metric in the vendor-assigned vector suggests the injection may be read-only in scope, but this is not explicitly confirmed by the description.

An attacker registers a free subscriber account on a WordPress site running Creative Mail ≤1.6.9, then submits a crafted HTTP request to a vulnerable plugin endpoint with a malicious SQL payload embedded in a subscriber-controlled parameter. The unsanitized input is passed directly to the database, allowing the attacker to enumerate and exfiltrate the WordPress database contents - including hashed passwords, email addresses, private posts, and plugin configuration data - through successive blind or error-based injection queries. No POC has been confirmed, but the low attack complexity (AC:L) means the technique is accessible to attackers with basic SQLi skills.