CVE-2026-3430 in Mail Plugin
Summary
by MITRE • 08/06/2026
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The Creative Mail WordPress plugin versions 1.6.5 through 1.6.9 contain a critical SQL injection vulnerability that stems from inadequate input validation and sanitization within the abandoned cart email functionality. This flaw exists in the plugin's handling of user-supplied parameters that are directly incorporated into SQL queries without proper escaping or sanitization mechanisms. The vulnerability specifically affects the plugin's abandoned cart email management feature, which processes customer data when cart abandonment occurs, creating an attack surface that can be exploited by unauthenticated threat actors.
The technical implementation of this vulnerability demonstrates a classic SQL injection flaw where user-controllable input flows directly into database queries without proper parameterization or escaping. When the abandoned cart email functionality is triggered, the plugin accepts parameters from external sources and incorporates them into SQL statements without adequate sanitization measures. This allows attackers to manipulate the database query structure through malicious input, potentially enabling them to extract sensitive data, modify database records, or even escalate privileges within the affected WordPress installation.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with a pathway to execute arbitrary SQL commands against the WordPress database. An unauthenticated attacker can exploit this weakness to gain unauthorized access to customer information, including email addresses and potentially personal details stored in the database. The vulnerability's exposure through the abandoned cart email functionality means that any visitor to the website could potentially trigger the malicious payload without requiring authentication credentials, making it particularly dangerous for e-commerce sites that rely heavily on customer data management.
Security practitioners should recognize this vulnerability as a variant of CWE-89 SQL Injection, which represents one of the most prevalent and dangerous web application security flaws in the industry. The attack surface aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS where attackers may leverage database access for further reconnaissance and lateral movement within compromised environments. Organizations utilizing Creative Mail plugin versions 1.6.5 through 1.6.9 should immediately implement mitigations including upgrading to the latest plugin version, implementing web application firewalls, and conducting comprehensive security assessments of affected systems. Additionally, administrators should review database access controls and implement proper input validation mechanisms to prevent similar vulnerabilities from occurring in other components of their WordPress installations.