Description

Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-06T15:17:16.603Z",
  "pubdate": "2026-08-06T15:17:16.603Z",
  "executiveSummary": "A SQL Injection vulnerability has been identified in the Creative Mail plugin, affecting all versions up to and including version 1.6.9. This security flaw arises from improper sanitization and handling of database queries within the affected component. An authenticated attacker with subscriber-level privileges or lower can exploit this vulnerability to manipulate SQL queries executed against the underlying database. The successful exploitation of this vulnerability can lead to severe security implications, including unauthorized access to sensitive database contents, data exfiltration, modification or deletion of critical records, and potentially complete compromise of the underlying WordPress installation depending on database privileges. The attack requires authenticated access, specifically a subscriber-level capability, meaning an attacker must possess a valid low-privileged user account on the target platform to initiate the attack sequence. The primary risk involves the unauthorized extraction of confidential information stored within the database tables, violating the confidentiality, integrity, and availability of the affected system.",
  "technicalDetails": "The vulnerability is classified as a SQL Injection (SQLi) flaw residing in the Creative Mail plugin <= 1.6.9. The root cause of the issue stems from the application accepting user-supplied input without proper sanitization, validation, or parameterization before incorporating it into dynamic SQL statements executed by the database abstraction layer. Specifically, the vulnerable component fails to enforce strict input type constraints and relies on unsafe string concatenation or inadequate escaping mechanisms when handling parameters submitted through plugin-specific endpoints. To execute the attack, an adversary with authenticated subscriber-level privileges sends a crafted HTTP request containing malicious SQL payloads directed at the vulnerable Creative Mail functionality. Upon receipt of the request, the vulnerable function processes the input and directly appends or interpolates the untrusted data into the SQL query string. The database server then evaluates the modified query structure, executing the attacker-controlled commands alongside or instead of the intended application logic. Depending on the structure of the vulnerable query, the payload behavior can manifest as union-based SQL injection, error-based extraction, or boolean-blind inference techniques. This allows the adversary to bypass intended authorization boundaries, extract sensitive data such as password hashes, user metadata, and configuration settings, or potentially escalate privileges within the application environment. Network exposure is inherent to the web application interface, requiring HTTP/HTTPS access to the target WordPress instance. Authentication is required, but the privilege requirement is limited to subscriber-level access, which is often obtainable via open registration or low-privilege account compromise. Post-exploitation impact encompasses total database compromise, potential remote code execution via administrative privilege escalation or database file manipulation, and sustained persistence within the compromised environment."
}