Intruder Details AI Pipeline That Found WordPress Plugin SQL Injection CVE
Summary
Intruder describes an AI-assisted Joern pipeline that identified CVE-2026-3985, a blind SQL injection in Creative Mail requiring WooCommerce. The plugin was pulled pending review; users are advised to disable it until a patch is available.
Key points
- Intruder says its pipeline analyzed the top 200 WordPress plugins, using Joern to generate code slices and LLM agents to triage findings and test exploitability.
- The process uses broad static-analysis rules, code slicing, basic taint checks, and staged models to focus on relevant call context.
- Intruder reports finding CVE-2026-3985, a blind SQL injection in the Creative Mail plugin; exploitation requires WooCommerce to also be installed.
- Intruder says its exploitation agent produced a proof of concept and a method capable of extracting database password hashes.
- The article says Dmitrii Ignatyev of CleanTalk independently found the vulnerability and reported it to Wordfence.
- Creative Mail was pulled from the WordPress store pending review; Intruder advises disabling it alongside WooCommerce until a patch is available.
Article Details
- Attack Vectors
- CVE-2026-3985 is a blind SQL injection in the Creative Mail WordPress plugin. The reported exploit is unauthenticated, remote, and uses multiple chained requests; WooCommerce must also be installed.
- The vulnerability can allow database reads, including password hashes and secret tokens. The article says the exploitation agent produced a proof of concept and a method for extracting password hashes.
- Defensive Notes
- Disable Creative Mail when it is installed alongside WooCommerce until a patch is available.
- The article reports that Creative Mail was pulled from the WordPress store pending review; it does not report that a patch is available.
- Intruder says vulnerabilities found by its pipeline become detection checks in its platform.
MITRE ATT&CK
CVE
People
Vendors
Products
Creative MailThe first bug the pipeline vended was CVE-2026-3985, a SQL injection vulnerability in the Creative Mail plugin.WooCommerceExploitation does require WooCommerce to be installed alongside Creative Mail, but since WooCommerce is a common reason people run WordPress (over 7 million active installs), the combination is common.WordPressWe walk through a remote, multi-stage SQL injection zero-day we discovered in a WordPress plugin with over 300,000 users — fully automated from discovery through exploitation, with no human in the loop.