CVE-2026-65547 in Creative Mail Plugin
Summary
by MITRE • 08/06/2026
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
Creative Mail for WordPress contains a subscriber SQL injection vulnerability affecting versions 1.6.9 and earlier. This flaw exists in the plugin's handling of user input within the subscriber management functionality, specifically when processing data from the wp_creative_mail_subscribers table. The vulnerability stems from insufficient sanitization of the $_GET parameter used in database queries that retrieve subscriber information. Attackers can exploit this by crafting malicious SQL payloads through the affected parameter, potentially gaining unauthorized access to sensitive subscriber data including email addresses, names, and associated metadata. The issue represents a classic sql injection vulnerability classified as CWE-89 under the Common Weakness Enumeration framework, which occurs when user-controllable input is directly incorporated into SQL commands without proper validation or escaping mechanisms.
The operational impact of this vulnerability extends beyond simple data exfiltration as it can enable attackers to manipulate the subscriber database entirely. Successful exploitation may allow adversaries to retrieve all stored subscriber records, modify existing entries, or even delete critical data. The vulnerability affects WordPress installations running Creative Mail versions up to 1.6.9, making it particularly concerning given the widespread use of WordPress and the plugin's functionality for email marketing automation. Attackers leveraging this vulnerability can potentially access personal information of thousands of users who have subscribed to newsletters or marketing campaigns managed through the plugin.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1213.002 for Data from Information Repositories, where adversaries target database systems to extract sensitive information. The attack surface is relatively narrow since it requires access to the WordPress admin interface or direct exploitation of the vulnerable endpoint, but the potential impact remains significant for organizations relying on email marketing automation. The vulnerability demonstrates poor input validation practices and highlights the importance of implementing proper parameterized queries or prepared statements as recommended by OWASP Top Ten Project guidelines for preventing sql injection attacks.
Mitigation strategies should prioritize immediate plugin updates to versions 1.6.10 or later where the vulnerability has been patched. Administrators should also implement proper input sanitization measures including the use of wp_kses() or similar validation functions before processing any user-supplied data in database queries. Network-level protections such as web application firewalls can provide additional defense-in-depth, though they should not replace proper code-level fixes. Regular security audits and penetration testing of WordPress installations are essential to identify similar vulnerabilities in other plugins or themes that may be susceptible to sql injection attacks. Organizations should also consider implementing database query logging and monitoring to detect potential exploitation attempts and establish incident response procedures for handling such security events effectively.