CVSS
8.6
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 6, 2026
Exploitability
EPSS probability 0.2%
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).