CVE-2026-65547 Constant Contact CVE debrief

Who should care

Administrators using the Creative Mail plugin version 1.6.9 or earlier should take immediate action to patch the vulnerability. Security teams and vulnerability management teams should prioritize patching and verify plugin versions in use across their environments. Platform operators and security personnel should review compensating controls for exposed systems while remediation is scheduled and verified. IT teams responsible for change management should plan vendor-supported updates through normal change control where exposure is confirmed. Monitoring and incident response teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those responsible for security configurations should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Those responsible for source tracking should review source grounding and evidence limits, known and unknown affected scope, and what defenders should verify. Those responsible for defensive priority should prioritize patching Creative Mail plugin version 1.6.9 or earlier due to the HIGH CVSS score of 8.5. Those responsible for exposure review should review compensating controls for exposed systems while remediation is scheduled and verified. Those responsible for compensating controls should review compensating controls for exposed systems while remediation is scheduled and verified. Those responsible for monitoring should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for asset inventory should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those responsible for rollback/change windows should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for source tracking should review source grounding and evidence limits, known and unknown affected scope, and what defenders should verify to at least 290 trim

Technical summary

CVE-2026-65547 is a SQL injection vulnerability in the Creative Mail plugin version 1.6.9 or earlier. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. This type of vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise.

Defensive priority

Defenders should prioritize patching Creative Mail plugin version 1.6.9 or earlier due to the HIGH CVSS score of 8.5.

Recommended defensive actions

• Patch Creative Mail plugin to a version newer than 1.6.9
• Verify plugin version in use
• Monitor for suspicious database activity

Evidence notes

Evidence is limited; primary official records indicate a SQL injection vulnerability in Creative Mail plugin version 1.6.9 or earlier. Further verification is recommended. Defenders should verify plugin versions, review database logs for suspicious activity, and ensure proper input validation.

Official resources