CVE-2026-3985: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in constantcontact Creative Mail – Easier WordPress & WooCommerce Email Marketing
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress contains an SQL Injection vulnerability in the 'checkout_uuid' parameter in versions up to 1. 6. 9. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries in the has_checkout_consent() method. It allows unauthenticated attackers to inject additional SQL commands, potentially exposing sensitive database information. The vulnerability has a high severity rating with a CVSS score of 7. 5. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
CVE-2026-3985 is an SQL Injection vulnerability in the Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin affecting all versions up to 1.6.9. The flaw exists due to improper neutralization of special elements in the 'checkout_uuid' parameter, specifically in the has_checkout_consent() method, which fails to properly escape user-supplied input before including it in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially extracting sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been published by the vendor as of the latest information.
Potential Impact
Successful exploitation of this vulnerability could allow unauthenticated attackers to retrieve sensitive information from the plugin's database by injecting arbitrary SQL commands. The confidentiality of the data is at risk, but integrity and availability impacts are not indicated. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable endpoints to mitigate risk. Monitor vendor communications for updates regarding patches or official mitigations.
CVE-2026-3985: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in constantcontact Creative Mail – Easier WordPress & WooCommerce Email Marketing
Description
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress contains an SQL Injection vulnerability in the 'checkout_uuid' parameter in versions up to 1. 6. 9. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries in the has_checkout_consent() method. It allows unauthenticated attackers to inject additional SQL commands, potentially exposing sensitive database information. The vulnerability has a high severity rating with a CVSS score of 7. 5. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3985 is an SQL Injection vulnerability in the Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin affecting all versions up to 1.6.9. The flaw exists due to improper neutralization of special elements in the 'checkout_uuid' parameter, specifically in the has_checkout_consent() method, which fails to properly escape user-supplied input before including it in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially extracting sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been published by the vendor as of the latest information.
Potential Impact
Successful exploitation of this vulnerability could allow unauthenticated attackers to retrieve sensitive information from the plugin's database by injecting arbitrary SQL commands. The confidentiality of the data is at risk, but integrity and availability impacts are not indicated. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable endpoints to mitigate risk. Monitor vendor communications for updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-11T14:46:25.631Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0d1a61ba1db473621f7aa3
Added to database: 5/20/2026, 2:20:17 AM
Last enriched: 5/20/2026, 2:33:59 AM
Last updated: 5/20/2026, 3:35:45 PM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.