Creative Mail
Monthly
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.