Executive brief
Creative Mail is a WordPress plugin that integrates email marketing and abandoned cart recovery functionality. Versions 1.6.5 through 1.6.9 contain an unauthenticated SQL injection vulnerability in the abandoned cart email handling feature, allowing attackers to execute arbitrary database queries, potentially exposing sensitive customer data including email addresses, purchase histories, and payment information.
Technical details
The vulnerability is a SQL injection (CWE-89) in the abandoned cart email management feature. The plugin fails to sanitize and escape the "ce4wp-recover" parameter before inserting it into an SQL statement, allowing unauthenticated attackers to inject arbitrary SQL code. The attack requires WooCommerce to be configured with Creative Mail managing abandoned cart emails, and the attacker must obtain a valid WooCommerce checkout nonce (retrievable by any guest during checkout). By crafting a malicious POST request to wp-admin/admin-ajax.php, an attacker can execute time-based blind SQL injection or extract data directly from the database. No patch is currently available.
Affected products
- Constant Contact Creative Mail 1.6.5 to 1.6.9
Timeline
- 2026-05-19: disclosed
- 2026-08-06: advisory