CVE-2026-3985

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/creative-mail-by-constant-contact/tags/1.6.9/src/Managers/CheckoutManager.php#L100
• https://plugins.trac.wordpress.org/browser/creative-mail-by-constant-contact/tags/1.6.9/src/Managers/DatabaseManager.php#L298
• https://plugins.trac.wordpress.org/browser/creative-mail-by-constant-contact/trunk/src/Managers/DatabaseManager.php#L298
• https://www.wordfence.com/threat-intel/vulnerabilities/id/39c17935-a853-407f-a99d-3828561919e6?source=cve

Published

May 20, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39844NiceGUI is a Python-based UI framework. Prior to 3.10.0, Sin…7.5
• CVE-2026-39845Weblate is a web based localization tool. In versions prior …4.1
• CVE-2026-39846SiYuan is a personal knowledge management system. Prior to 3…9
• CVE-2026-39847Emmett is a full-stack Python web framework designed with si…7.5
• CVE-2026-39848Dockyard is a Docker container management app. Prior to 1.1.…5.4
• CVE-2026-39849Pi-hole FTL is the core engine of the Pi-hole network-level …8.8
• CVE-2026-39850Yii 2 is a PHP application framework. Versions 2.0.54 and pr…7.4
• CVE-2026-39851Saleor is an e-commerce platform. From 2.10.0 to before 3.23…4.3
• CVE-2026-39852Quarkus is a Java framework for building cloud-native applic…8.2
• CVE-2026-39853osslsigncode is a tool that implements Authenticode signing …7.8
• CVE-2026-39855osslsigncode is a tool that implements Authenticode signing …5.5
• CVE-2026-39856osslsigncode is a tool that implements Authenticode signing …5.5