WordPress Creative Mail SQL Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Creative Mail has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to obtain sensitive...

CVE-2026-3430

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-65547

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-3985...

CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

EUVD-2026-54088

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-3430

CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...

CVE-2026-65547

The Creative Mail plugin for WordPress and WooCommerce (versions prior to 1.7.0 and

CVE-2026-65547

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65547

...

EUVD-2026-53977

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65547

...

PT-2026-68617

Name of the Vulnerable Software and Affected Versions Creative Mail versions 1.6.5 through 1.6.9 Description The Creative Mail WordPress plugin fails to sanitize and escape a parameter before incorporating it into an SQL statement. This flaw allows an unauthenticated user to perform an SQL...

CVE-2026-3430: Improper Neutralization of Special Elements used in an SQL Command

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-65547: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taichi Kashimura in WordPress Plugin Creative Mail versions = 1.6.9...

PT-2026-68548

Name of the Vulnerable Software and Affected Versions Creative Mail versions prior to 1.7.0 Description An issue exists in the Creative Mail plugin for WordPress and WooCommerce where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticat...

WordPress Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin <= 1.6.9 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Creative Mail versions = 1.6.9...

CVE-2026-3985

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkoutuuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2026-3985 Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkoutuuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...