CVE-2026-65547

Name of the Vulnerable Software and Affected Versions Creative Mail versions prior to 1.7.0

Description An issue exists in the Creative Mail plugin for WordPress and WooCommerce where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with subscriber-level access or higher to perform SQL Injection. This allows the addition of malicious SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update to a version newer than 1.6.9.