SQL Injection Vulnerability in Creative Mail by Constant Contact for WordPress
CVE-2026-3985

7.5HIGH

Key Information:

Vendor

WordPress
Status
Creative Mail – Easier WordPress & WooCommerce Email Marketing
Vendor
CVE Published:
20 May 2026

What is CVE-2026-3985?

The Creative Mail plugin for WordPress is susceptible to SQL Injection attacks through the 'checkout_uuid' parameter. This vulnerability exists in all versions up to and including 1.6.9 and is attributed to inadequate parameter escaping and insufficient SQL query preparation in the has_checkout_consent() method. Attackers lacking authentication can exploit this flaw to inject their own SQL queries, potentially allowing them to retrieve sensitive data from the database, posing significant risks to website integrity and user privacy.

Affected Version(s)

Creative Mail – Easier WordPress & WooCommerce Email Marketing 0 <= 1.6.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/creative-mail-...
https://plugins.trac.wordpress.org/browser/creative-mail-...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.