PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3430 Creative Mail CVE debrief

The Creative Mail WordPress plugin, versions 1.6.5 to 1.6.9, is vulnerable to an unauthenticated SQL injection attack due to improper sanitization and escaping of a parameter used in an SQL statement. This vulnerability has a CVSS score of 8.6, indicating high severity. WordPress site administrators and users of the Creative Mail plugin should be aware of this vulnerability and take necessary actions to mitigate the risk. The CVE record was published on 2026-08-06T16:16:42.760Z and has not been modified since then. Further verification is required to fully understand the vulnerability's impact.

Vendor
Creative Mail
Product
Creative Mail WordPress plugin
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-26
Advisory published
2026-08-06
Advisory updated
2026-08-26

Who should care

WordPress site administrators, users of the Creative Mail plugin, and security teams responsible for monitoring and patching vulnerabilities in WordPress plugins should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The Creative Mail WordPress plugin from version 1.6.5 to 1.6.9 is vulnerable to an unauthenticated SQL injection attack due to improper sanitization and escaping of a parameter used in an SQL statement. This vulnerability has been publicly disclosed and has a CVSS score of 8.6, indicating a high severity level. The vulnerability affects WordPress site administrators and users of the Creative Mail plugin, who should prioritize patching to prevent potential SQL injection attacks.

Defensive priority

WordPress site administrators and users of the Creative Mail plugin should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

  • Patch the Creative Mail WordPress plugin to a version beyond 1.6.9
  • Implement additional monitoring and logging to detect potential SQL injection attempts
  • Review and update incident response plans to address potential SQL injection attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates that the Creative Mail WordPress plugin from version 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using it in an SQL statement, leading to an unauthenticated SQL injection vulnerability. However, details are limited, and further verification is required to fully understand the vulnerability's impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3430 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3430

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3430 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3430

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.