The Creative Mail WordPress plugin from version 1.6.5 through 1.6.9 fails to sanitize and escape a request parameter that is later concatenated into an SQL statement. This omission allows an attacker to inject arbitrary SQL when the abandoned cart email function is accessed, potentially enabling data exfiltration, modification or deletion in the site’s database. The flaw is a classic injection weakness, directly affecting confidentiality, integrity, and possibly availability of WordPress content.

Any WordPress installation that has the Creative Mail plugin version 1.6.5, 1.6.6, 1.6.7, 1.6.8, or 1.6.9 installed is vulnerable. The attack surface is the plugin’s abandoned cart email handling endpoint, which is typically exposed on the public web regardless of user authentication.

With a CVSS score of 8.6, the vulnerability is considered High severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, implying no widespread public exploitation has been documented yet. The likely attack vector is an HTTP request to the abandoned cart email URL; no authentication is required, so any entity on the internet can send malicious payloads and potentially compromise the underlying database.