This vulnerability (CVE-2026-65547) is an SQL Injection issue classified under CWE-89 in Constant Contact's Creative Mail product. It affects all versions up to and including 1.6.9. The flaw arises from improper neutralization of special elements used in SQL commands related to subscriber data, which could allow an attacker with low privileges and no user interaction to execute unauthorized SQL queries. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to access sensitive subscriber data, compromising confidentiality. The vulnerability does not impact data integrity but may cause limited disruption to availability. The attack requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider applying compensating controls such as input validation and restricting database permissions related to subscriber data access. Monitor vendor channels for updates.