CVE-2026-3430

15th percentile - higher than 15% of all known CVEs

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

The risk includes the possibility of unauthorized access to the database, which could lead to data leakage, modification, or deletion. The attack requires no authentication, so it can be carried out by anyone.

It is recommended to immediately update the Creative Mail plugin to the latest version that contains the fix. Also, check logs for suspicious SQL queries.