CVE-2026-3430 — Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi

CVE-2026-3430

Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi PUBLISHED

Description (CNA)

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

Affected (CNA)

Vendor / product	Versions
Unknown / Creative Mail	affected 1.6.5 through 1.6.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/eb2f34bd-c626-4831-a886-c82882073bcd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.