Creative Mail WordPress Plugin SQLi Exposes User Data
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin, in all versions up to and including 1.6.9, is vulnerable to SQL Injection. The National Vulnerability Database reports this flaw, identified as CVE-2026-3985, stems from insufficient escaping of the ‘checkout_uuid’ parameter and inadequate preparation of the SQL query within the has_checkout_consent() method. This isn’t just a theoretical bug; it’s a critical oversight that attackers will absolutely leverage.
An unauthenticated attacker can exploit this vulnerability to inject malicious SQL queries, bypassing authentication entirely. The primary impact, according to the National Vulnerability Database, is the extraction of sensitive information directly from the underlying database. This means customer data, order details, or even user credentials could be siphoned off, leading to significant data breaches and compliance nightmares for any organization running this plugin.
The CVSSv3.1 score for CVE-2026-3985 is 7.5 (High severity), underscoring the ease of exploitation (AV:N, AC:L, PR:N, UI:N) and the high impact on confidentiality (C:H). Defenders must recognize that unauthenticated SQLi is a golden ticket for attackers. It provides direct access to the crown jewels of many web applications – the database. Patching immediately isn’t just recommended; it’s a non-negotiable requirement.
What This Means For You
- If your organization uses the Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin, you must immediately verify your version. Patch to a fixed version as soon as one is available. Until then, consider disabling the plugin or implementing web application firewall (WAF) rules to specifically block SQL injection attempts targeting the `checkout_uuid` parameter.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-3985 - Creative Mail Plugin SQL Injection via checkout_uuid
title: CVE-2026-3985 - Creative Mail Plugin SQL Injection via checkout_uuid
id: scw-2026-05-20-ai-1
status: experimental
level: critical
description: |
Detects SQL Injection attempts targeting the Creative Mail WordPress plugin by looking for the specific 'checkout_uuid' parameter in the query string within the plugin's directory. This is the primary vector for CVE-2026-3985, allowing unauthenticated attackers to extract sensitive data.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-3985/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'checkout_uuid='
cs-uri|contains:
- '/wp-content/plugins/creative-mail/'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-3985 | SQLi | Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin <= 1.6.9 |
| CVE-2026-3985 | SQLi | Vulnerable parameter: 'checkout_uuid' |
| CVE-2026-3985 | SQLi | Vulnerable method: `has_checkout_consent()` |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 20, 2026 at 05:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...