Description

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-06T16:16:42.760Z",
  "pubdate": "2026-08-06T16:16:42.760Z",
  "executiveSummary": "The Creative Mail WordPress plugin, spanning versions 1.6.5 to 1.6.9, suffers from an unauthenticated SQL Injection vulnerability. The security flaw stems from a failure to properly sanitize and escape a user-supplied parameter before incorporating it directly into an SQL statement.\nThe vulnerability resides within the functionality responsible for managing abandoned cart emails. Because the flaw is accessible without authentication, an unauthenticated remote attacker can supply malicious SQL payloads to interact directly with the underlying database.\nSuccessful exploitation of this vulnerability can lead to severe security implications, including unauthorized read and write access to sensitive database contents, potential data exfiltration, and possible remote code execution or complete site compromise depending on the database privileges and configuration.\nMitigation requires upgrading the Creative Mail plugin to a secure version beyond 1.6.9 where input sanitization and parameterization are correctly implemented for SQL queries.",
  "technicalDetails": "The root cause of the vulnerability is improper input validation and lack of output escaping within the Creative Mail WordPress plugin. Specifically, parameters processed during the management and handling of abandoned cart email workflows are concatenated directly into SQL queries without prior sanitization or utilization of prepared statements.\nThe vulnerable component is the abandoned cart email management logic exposed by the Creative Mail plugin. The affected versions are explicitly 1.6.5 through 1.6.9. The vulnerability requires network exposure via the web application interface and can be exploited by unauthenticated threat actors, meaning no prior privileges or valid user accounts are required to initiate the attack.\nThe attack flow proceeds as follows: 1. The attacker crafts a specialized HTTP request targeting the vulnerable abandoned cart email endpoint within the Creative Mail plugin. 2. The malicious input includes SQL metacharacters and crafted injection payloads designed to manipulate the intended SQL query structure. 3. The vulnerable component accepts the parameter and dynamically concatenates it directly into the active SQL statement without escaping or utilizing database abstraction layers like wpdb prepare methods. 4. The database execution engine processes the modified query, allowing the attacker to execute arbitrary SQL commands. 5. The attacker can leverage this capability to extract sensitive information, such as user credentials, session tokens, or other application data stored in the WordPress database, or potentially alter database records."
}