CVE-2026-3985

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.41%
EPSS Percentile: 34.61%
CISA KEV: Not listed

Description

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 20-May-2026 09:16
Last Modified: 22-Aug-2026 02:17
EPSS Date: 2026-10-27
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

References

Last enrichment sync: 28-Oct-2026 11:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The first bug the pipeline vended was CVE-2026-3985, a SQL injection vulnerability in the Creative Mail plugin. Intruder Details AI Pipeline That Found WordPress Plugin SQL Injection CVE

People (1)

MITRE ATT&CK (1)

Vendors (1)

Products (3)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.