EUVD-2026-53977
GHSA-3jfp-8ffg-83g9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-accessible, subscriber-authenticated SQLi with scope change to shared DB; I:L reflects typical SQL injection write potential; no meaningful availability impact identified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
AnalysisAI
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid subscriber-level WordPress account (PR:L per CVSS), which is the lowest authenticated role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 score is driven primarily by the S:C scope change and C:H confidentiality impact, reflecting the ability to read across the full WordPress database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running Creative Mail ≤1.6.9, then submits a crafted HTTP request to a vulnerable plugin endpoint with a malicious SQL payload embedded in a subscriber-controlled parameter. The unsanitized input is passed directly to the database, allowing the attacker to enumerate and exfiltrate the WordPress database contents - including hashed passwords, email addresses, private posts, and plugin configuration data - through successive blind or error-based injection queries. … |
| Remediation | Update Creative Mail to a version beyond 1.6.9 as soon as a patched release is available via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/creative-mail-by-constant-contact/vulnerability/wordpress-creative-mail-plugin-1-6-9-sql-injection-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately disable the Creative Mail by Constant Contact plugin (version ≤1.6.9) across all WordPress installations and document the current version on each instance using wp plugin list or the WordPress admin dashboard. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Creative Mail
View allUnauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to re
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. Rated high sev
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today