Creative Mail WordPress Plugin CVE-2026-3985: Brief Summary of Unauthenticated SQL Injection via checkout_uuid

Introduction

An unauthenticated SQL injection in the Creative Mail plugin for WordPress lets remote attackers extract sensitive information directly from the database. No login is required and no user interaction is needed. The plugin is purpose-built for WooCommerce integration, so affected sites are likely to hold customer PII, order data, and payment metadata. That raises the stakes of the confidentiality impact considerably.

Creative Mail is an email marketing plugin from Constant Contact, designed from the ground up as a WordPress-first marketing service. It integrates deeply with both Jetpack and WooCommerce and is aimed at ecommerce operators who run email campaigns. Because it sits on commerce-oriented sites, the databases it touches routinely contain high-value customer and transactional data.

Technical Information

CVE-2026-3985 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The CVSS 3.1 score is 7.5, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. In plain terms, the attack works over the network, has low complexity, needs no privileges or user interaction, and has a high confidentiality impact with no direct integrity or availability impact.

Root Cause

The vulnerability is in the has_checkout_consent() method in the plugin's CheckoutManager.php file. This method takes a checkout_uuid parameter from user input and passes it into a SQL query without sufficient escaping. It does not use WordPress's $wpdb->prepare() function or any equivalent parameterized query mechanism. The vulnerable code path runs through two files in the 1.6.9 release:

1. CheckoutManager.php at line 100, where the checkout_uuid value is received
2. DatabaseManager.php at line 298, where the unsanitized value is incorporated into the SQL query

The checkout_uuid value is concatenated or interpolated directly into the query string instead of being bound as a parameter, so an attacker can inject arbitrary SQL fragments.

Attack Flow

Exploitation is straightforward:

1. An attacker identifies a WordPress site running the Creative Mail plugin at version 1.6.9 or earlier. Standard WordPress fingerprinting techniques make plugin detection trivial.
2. The attacker crafts a request that supplies a malicious checkout_uuid value. The parameter is reachable without authentication, so no WordPress account or session is needed.
3. The malicious checkout_uuid value carries appended SQL statements. Because the has_checkout_consent() method does not properly escape or parameterize this input, the injected SQL runs as part of the existing query.
4. Using techniques such as UNION-based injection, blind boolean-based injection, or time-based blind injection, the attacker extracts data from the WordPress database. This can include user credentials, customer records, WooCommerce order details, and anything else stored in the database.

The whole attack is exploitable over the network with low complexity. It requires no special conditions, no elevated privileges, and no victim interaction. That profile makes the vulnerability highly susceptible to automated scanning and mass exploitation.

Confirmed Technical Parameters

Affected Systems and Versions

All versions of the Creative Mail (Easier WordPress and WooCommerce Email Marketing) plugin from version 0 through version 1.6.9 inclusive are affected. The plugin's WordPress slug is creative-mail-by-constant-contact.

Any WordPress installation running one of these versions is vulnerable regardless of configuration, because unauthenticated users can reach the vulnerable code path. Sites that also run WooCommerce face a higher risk of data exposure because of the kind of data they store.

As of May 14, 2026, the plugin has been closed on the WordPress plugin repository and is no longer available for new downloads. The closure is marked as temporary, pending a full review. No patched version has been released.

References

• Wordfence Threat Intelligence Advisory for CVE-2026-3985
• CVE Record: CVE-2026-3985
• Vulnerable Source: CheckoutManager.php (line 100, version 1.6.9)
• Vulnerable Source: DatabaseManager.php (line 298, version 1.6.9)
• Trunk Source: DatabaseManager.php (line 298)
• WordPress Plugin Page: Creative Mail by Constant Contact
• Jetpack: Introducing Creative Mail for Jetpack
• Constant Contact Official Site