The Creative Mail WordPress plugin versions 1.6.5 to 1.6.9 contain an SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of a parameter before its use in an SQL query. This vulnerability can be exploited without authentication when managing abandoned cart emails, allowing attackers to inject malicious SQL commands. The CVSS 3.1 base score is 8.6, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and a significant confidentiality impact without affecting integrity or availability. No known exploits in the wild or official remediation have been reported as of the publication date.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the Creative Mail plugin's database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not directly affect data integrity or availability according to the CVSS vector. Exploitation requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected functionality or plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.