CVE-2026-3430 is an SQL injection vulnerability in the Creative Mail WordPress plugin affecting versions 1.6.5 to 1.6.9. The vulnerability arises because the plugin does not properly sanitize and escape a parameter before incorporating it into an SQL query. This issue can be exploited without authentication when the abandoned cart email feature is managed by Creative Mail, potentially allowing attackers to execute arbitrary SQL commands. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. The vulnerability affects confidentiality but does not impact integrity or availability according to the CVSS vector.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the abandoned cart email feature or restricting access to the affected functionality to trusted users only.