CVE-2026-3430 Creative Mail CVE debrief

Who should care

WordPress site administrators, users of the Creative Mail plugin, and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The Creative Mail WordPress plugin from version 1.6.5 to 1.6.9 is vulnerable to an unauthenticated SQL injection attack due to improper sanitization and escaping of a parameter used in an SQL statement. This vulnerability has been publicly disclosed and has a CVSS score of 8.6, indicating a high severity level. The vulnerability affects WordPress site administrators and users of the Creative Mail plugin, who should prioritize patching to prevent potential SQL injection attacks.

Defensive priority

WordPress site administrators and users of the Creative Mail plugin should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

• Patch the Creative Mail WordPress plugin to a version beyond 1.6.9
• Implement additional monitoring and logging to detect potential SQL injection attempts
• Review and update incident response plans to address potential SQL injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates that the Creative Mail WordPress plugin from version 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using it in an SQL statement, leading to an unauthenticated SQL injection vulnerability. However, details are limited, and further verification is required to fully understand the vulnerability's impact.

Official resources