CVE-2026-3985 is an SQL Injection vulnerability in the Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin affecting all versions up to 1.6.9. The flaw exists due to improper neutralization of special elements in the 'checkout_uuid' parameter, specifically in the has_checkout_consent() method, which fails to properly escape user-supplied input before including it in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially extracting sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been published by the vendor as of the latest information.

Successful exploitation of this vulnerability could allow unauthenticated attackers to retrieve sensitive information from the plugin's database by injecting arbitrary SQL commands. The confidentiality of the data is at risk, but integrity and availability impacts are not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable endpoints to mitigate risk. Monitor vendor communications for updates regarding patches or official mitigations.